diff --git a/scripts/base/files/extract/main.bro b/scripts/base/files/extract/main.bro index b2d1907e01..eaae44a089 100644 --- a/scripts/base/files/extract/main.bro +++ b/scripts/base/files/extract/main.bro @@ -75,7 +75,7 @@ event file_extraction_limit(f: fa_file, args: Files::AnalyzerArgs, limit: count, f$info$extracted_size = limit; } -event bro_init() &priority=10 +event zeek_init() &priority=10 { Files::register_analyzer_add_callback(Files::ANALYZER_EXTRACT, on_add); } diff --git a/scripts/base/files/pe/main.bro b/scripts/base/files/pe/main.bro index 972e8a31c8..2016d53901 100644 --- a/scripts/base/files/pe/main.bro +++ b/scripts/base/files/pe/main.bro @@ -55,7 +55,7 @@ redef record fa_file += { const pe_mime_types = { "application/x-dosexec" }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_for_mime_types(Files::ANALYZER_PE, pe_mime_types); Log::create_stream(LOG, [$columns=Info, $ev=log_pe, $path="pe"]); diff --git a/scripts/base/files/unified2/main.bro b/scripts/base/files/unified2/main.bro index 4670ff35c1..1a9841d5b1 100644 --- a/scripts/base/files/unified2/main.bro +++ b/scripts/base/files/unified2/main.bro @@ -193,7 +193,7 @@ event Input::end_of_data(name: string, source: string) start_watching(); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Unified2::LOG, [$columns=Info, $ev=log_unified2, $path="unified2"]); diff --git a/scripts/base/files/x509/main.bro b/scripts/base/files/x509/main.bro index b6fdde5494..e674ae8888 100644 --- a/scripts/base/files/x509/main.bro +++ b/scripts/base/files/x509/main.bro @@ -29,7 +29,7 @@ export { global log_x509: event(rec: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(X509::LOG, [$columns=Info, $ev=log_x509, $path="x509"]); diff --git a/scripts/base/frameworks/analyzer/main.bro b/scripts/base/frameworks/analyzer/main.bro index 39b0d573fd..57a602f308 100644 --- a/scripts/base/frameworks/analyzer/main.bro +++ b/scripts/base/frameworks/analyzer/main.bro @@ -135,7 +135,7 @@ export { global ports: table[Analyzer::Tag] of set[port]; -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( disable_all ) __disable_all_analyzers(); diff --git a/scripts/base/frameworks/broker/log.bro b/scripts/base/frameworks/broker/log.bro index 2461cb8d54..bd76684b74 100644 --- a/scripts/base/frameworks/broker/log.bro +++ b/scripts/base/frameworks/broker/log.bro @@ -30,7 +30,7 @@ export { }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Broker::LOG, [$columns=Info, $path="broker"]); } diff --git a/scripts/base/frameworks/broker/main.bro b/scripts/base/frameworks/broker/main.bro index 9be261eaf1..93ed69c3c5 100644 --- a/scripts/base/frameworks/broker/main.bro +++ b/scripts/base/frameworks/broker/main.bro @@ -298,7 +298,7 @@ export { ## Register interest in all peer event messages that use a certain topic ## prefix. Note that subscriptions may not be altered immediately after - ## calling (except during :bro:see:`bro_init`). + ## calling (except during :bro:see:`zeek_init`). ## ## topic_prefix: a prefix to match against remote message topics. ## e.g. an empty prefix matches everything and "a" matches @@ -309,7 +309,7 @@ export { ## Unregister interest in all peer event messages that use a topic prefix. ## Note that subscriptions may not be altered immediately after calling - ## (except during :bro:see:`bro_init`). + ## (except during :bro:see:`zeek_init`). ## ## topic_prefix: a prefix previously supplied to a successful call to ## :bro:see:`Broker::subscribe` or :bro:see:`Broker::forward`. diff --git a/scripts/base/frameworks/cluster/main.bro b/scripts/base/frameworks/cluster/main.bro index 2d492454d4..4a66315d1b 100644 --- a/scripts/base/frameworks/cluster/main.bro +++ b/scripts/base/frameworks/cluster/main.bro @@ -359,7 +359,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) &priority=1 } } -event bro_init() &priority=5 +event zeek_init() &priority=5 { # If a node is given, but it's an unknown name we need to fail. if ( node != "" && node !in nodes ) diff --git a/scripts/base/frameworks/cluster/pools.bro b/scripts/base/frameworks/cluster/pools.bro index 8f4e92b922..40f9a9cbf1 100644 --- a/scripts/base/frameworks/cluster/pools.bro +++ b/scripts/base/frameworks/cluster/pools.bro @@ -324,7 +324,7 @@ function mark_pool_node_dead(pool: Pool, name: string): bool return T; } -event bro_init() +event zeek_init() { worker_pool = register_pool(worker_pool_spec); proxy_pool = register_pool(proxy_pool_spec); @@ -344,8 +344,8 @@ function pool_sorter(a: Pool, b: Pool): int return strcmp(a$spec$topic, b$spec$topic); } -# Needs to execute before the bro_init in setup-connections -event bro_init() &priority=-5 +# Needs to execute before the zeek_init in setup-connections +event zeek_init() &priority=-5 { if ( ! Cluster::is_enabled() ) return; diff --git a/scripts/base/frameworks/cluster/setup-connections.bro b/scripts/base/frameworks/cluster/setup-connections.bro index a90081c639..004dd22f2a 100644 --- a/scripts/base/frameworks/cluster/setup-connections.bro +++ b/scripts/base/frameworks/cluster/setup-connections.bro @@ -42,7 +42,7 @@ function connect_peers_with_type(node_type: NodeType) } } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { if ( getenv("BROCTL_CHECK_CONFIG") != "" ) return; diff --git a/scripts/base/frameworks/config/input.bro b/scripts/base/frameworks/config/input.bro index 7c1f37567b..9796d69f57 100644 --- a/scripts/base/frameworks/config/input.bro +++ b/scripts/base/frameworks/config/input.bro @@ -34,7 +34,7 @@ event config_line(description: Input::EventDescription, tpe: Input::Event, p: Ev { } -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( Cluster::is_enabled() && Cluster::local_node_type() != Cluster::MANAGER ) return; diff --git a/scripts/base/frameworks/config/main.bro b/scripts/base/frameworks/config/main.bro index 2f9dbfc720..aacebbc530 100644 --- a/scripts/base/frameworks/config/main.bro +++ b/scripts/base/frameworks/config/main.bro @@ -150,7 +150,7 @@ function config_option_changed(ID: string, new_value: any, location: string): an return new_value; } -event bro_init() &priority=10 +event zeek_init() &priority=10 { Log::create_stream(LOG, [$columns=Info, $ev=log_config, $path="config"]); diff --git a/scripts/base/frameworks/config/weird.bro b/scripts/base/frameworks/config/weird.bro index bc311e3029..5e55b0b188 100644 --- a/scripts/base/frameworks/config/weird.bro +++ b/scripts/base/frameworks/config/weird.bro @@ -35,7 +35,7 @@ function weird_option_change_interval(ID: string, new_value: interval, location: return new_value; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Option::set_change_handler("Weird::sampling_whitelist", weird_option_change_sampling_whitelist, 5); Option::set_change_handler("Weird::sampling_threshold", weird_option_change_count, 5); diff --git a/scripts/base/frameworks/dpd/main.bro b/scripts/base/frameworks/dpd/main.bro index cce8b362d5..c6a3515bc3 100644 --- a/scripts/base/frameworks/dpd/main.bro +++ b/scripts/base/frameworks/dpd/main.bro @@ -39,7 +39,7 @@ redef record connection += { dpd: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DPD::LOG, [$columns=Info, $path="dpd"]); } diff --git a/scripts/base/frameworks/files/main.bro b/scripts/base/frameworks/files/main.bro index d3d37b30ab..fc75d68e8e 100644 --- a/scripts/base/frameworks/files/main.bro +++ b/scripts/base/frameworks/files/main.bro @@ -324,7 +324,7 @@ global mime_type_to_analyzers: table[string] of set[Files::Tag]; global analyzer_add_callbacks: table[Files::Tag] of function(f: fa_file, args: AnalyzerArgs) = table(); -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Files::LOG, [$columns=Info, $ev=log_files, $path="files"]); } diff --git a/scripts/base/frameworks/intel/cluster.bro b/scripts/base/frameworks/intel/cluster.bro index b71e8c47ea..2d51ffb200 100644 --- a/scripts/base/frameworks/intel/cluster.bro +++ b/scripts/base/frameworks/intel/cluster.bro @@ -16,7 +16,7 @@ redef have_full_data = F; @endif @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, remove_indicator); } @@ -67,7 +67,7 @@ event Intel::match_remote(s: Seen) &priority=5 @endif @if ( Cluster::local_node_type() == Cluster::WORKER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, match_remote); Broker::auto_publish(Cluster::manager_topic, remove_item); diff --git a/scripts/base/frameworks/intel/input.bro b/scripts/base/frameworks/intel/input.bro index aea3ac9a35..4dfa011fad 100644 --- a/scripts/base/frameworks/intel/input.bro +++ b/scripts/base/frameworks/intel/input.bro @@ -27,7 +27,7 @@ event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::insert(item); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( ! Cluster::is_enabled() || Cluster::local_node_type() == Cluster::MANAGER ) diff --git a/scripts/base/frameworks/intel/main.bro b/scripts/base/frameworks/intel/main.bro index 4bc3b296dd..f59323369d 100644 --- a/scripts/base/frameworks/intel/main.bro +++ b/scripts/base/frameworks/intel/main.bro @@ -223,7 +223,7 @@ type MinDataStore: record { global min_data_store: MinDataStore &redef; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(LOG, [$columns=Info, $ev=log_intel, $path="intel"]); } diff --git a/scripts/base/frameworks/logging/postprocessors/scp.bro b/scripts/base/frameworks/logging/postprocessors/scp.bro index d63520abe6..462cb86b20 100644 --- a/scripts/base/frameworks/logging/postprocessors/scp.bro +++ b/scripts/base/frameworks/logging/postprocessors/scp.bro @@ -2,7 +2,7 @@ ##! to a logging filter in order to automatically SCP (secure copy) ##! a log stream (or a subset of it) to a remote host at configurable ##! rotation time intervals. Generally, to use this functionality -##! you must handle the :bro:id:`bro_init` event and do the following +##! you must handle the :bro:id:`zeek_init` event and do the following ##! in your handler: ##! ##! 1) Create a new :bro:type:`Log::Filter` record that defines a name/path, diff --git a/scripts/base/frameworks/logging/postprocessors/sftp.bro b/scripts/base/frameworks/logging/postprocessors/sftp.bro index 8c77899864..803851261f 100644 --- a/scripts/base/frameworks/logging/postprocessors/sftp.bro +++ b/scripts/base/frameworks/logging/postprocessors/sftp.bro @@ -2,7 +2,7 @@ ##! to a logging filter in order to automatically SFTP ##! a log stream (or a subset of it) to a remote host at configurable ##! rotation time intervals. Generally, to use this functionality -##! you must handle the :bro:id:`bro_init` event and do the following +##! you must handle the :bro:id:`zeek_init` event and do the following ##! in your handler: ##! ##! 1) Create a new :bro:type:`Log::Filter` record that defines a name/path, diff --git a/scripts/base/frameworks/netcontrol/catch-and-release.bro b/scripts/base/frameworks/netcontrol/catch-and-release.bro index 79de7d9662..83d9e1d7af 100644 --- a/scripts/base/frameworks/netcontrol/catch-and-release.bro +++ b/scripts/base/frameworks/netcontrol/catch-and-release.bro @@ -163,7 +163,7 @@ export { # Set that is used to only send seen notifications to the master every ~30 seconds. global catch_release_recently_notified: set[addr] &create_expire=30secs; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::CATCH_RELEASE, [$columns=CatchReleaseInfo, $ev=log_netcontrol_catch_release, $path="netcontrol_catch_release"]); } @@ -227,13 +227,13 @@ global blocks: table[addr] of BlockInfo = {} @if ( Cluster::is_enabled() ) @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, NetControl::catch_release_block_new); Broker::auto_publish(Cluster::worker_topic, NetControl::catch_release_block_delete); } @else -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, NetControl::catch_release_add); Broker::auto_publish(Cluster::manager_topic, NetControl::catch_release_delete); diff --git a/scripts/base/frameworks/netcontrol/cluster.bro b/scripts/base/frameworks/netcontrol/cluster.bro index d70ab6d1c1..3fbd4cd6a1 100644 --- a/scripts/base/frameworks/netcontrol/cluster.bro +++ b/scripts/base/frameworks/netcontrol/cluster.bro @@ -17,7 +17,7 @@ export { } @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, NetControl::rule_added); Broker::auto_publish(Cluster::worker_topic, NetControl::rule_removed); @@ -28,7 +28,7 @@ event bro_init() Broker::auto_publish(Cluster::worker_topic, NetControl::rule_destroyed); } @else -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, NetControl::cluster_netcontrol_add_rule); Broker::auto_publish(Cluster::manager_topic, NetControl::cluster_netcontrol_remove_rule); diff --git a/scripts/base/frameworks/netcontrol/drop.bro b/scripts/base/frameworks/netcontrol/drop.bro index 8b31996057..40304e1187 100644 --- a/scripts/base/frameworks/netcontrol/drop.bro +++ b/scripts/base/frameworks/netcontrol/drop.bro @@ -55,7 +55,7 @@ export { global log_netcontrol_drop: event(rec: DropInfo); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::DROP, [$columns=DropInfo, $ev=log_netcontrol_drop, $path="netcontrol_drop"]); } diff --git a/scripts/base/frameworks/netcontrol/main.bro b/scripts/base/frameworks/netcontrol/main.bro index a9418508af..b85d42046a 100644 --- a/scripts/base/frameworks/netcontrol/main.bro +++ b/scripts/base/frameworks/netcontrol/main.bro @@ -262,7 +262,7 @@ export { ##### Plugin functions ## Function called by plugins once they finished their activation. After all - ## plugins defined in bro_init finished to activate, rules will start to be sent + ## plugins defined in zeek_init finished to activate, rules will start to be sent ## to the plugins. Rules that scripts try to set before the backends are ready ## will be discarded. global plugin_activated: function(p: PluginState); @@ -338,13 +338,13 @@ redef record Rule += { }; # Variable tracking the state of plugin activation. Once all plugins that -# have been added in bro_init are activated, this will switch to T and +# have been added in zeek_init are activated, this will switch to T and # the event NetControl::init_done will be raised. global plugins_active: bool = F; -# Set to true at the end of bro_init (with very low priority). +# Set to true at the end of zeek_init (with very low priority). # Used to track when plugin activation could potentially be finished -global bro_init_done: bool = F; +global zeek_init_done: bool = F; # The counters that are used to generate the rule and plugin IDs global rule_counter: count = 1; @@ -364,7 +364,7 @@ global rules_by_subnets: table[subnet] of set[string]; # There always only can be one rule of each type for one entity. global rule_entities: table[Entity, RuleType] of Rule; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::LOG, [$columns=Info, $ev=log_netcontrol, $path="netcontrol"]); } @@ -613,18 +613,18 @@ function plugin_activated(p: PluginState) plugin_ids[id]$_activated = T; log_msg("activation finished", p); - if ( bro_init_done ) + if ( zeek_init_done ) check_plugins(); } -event bro_init() &priority=-5 +event zeek_init() &priority=-5 { event NetControl::init(); } event NetControl::init() &priority=-20 { - bro_init_done = T; + zeek_init_done = T; check_plugins(); diff --git a/scripts/base/frameworks/netcontrol/shunt.bro b/scripts/base/frameworks/netcontrol/shunt.bro index 1275be1560..58923a0cb3 100644 --- a/scripts/base/frameworks/netcontrol/shunt.bro +++ b/scripts/base/frameworks/netcontrol/shunt.bro @@ -36,7 +36,7 @@ export { global log_netcontrol_shunt: event(rec: ShuntInfo); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::SHUNT, [$columns=ShuntInfo, $ev=log_netcontrol_shunt, $path="netcontrol_shunt"]); } diff --git a/scripts/base/frameworks/notice/actions/pp-alarms.bro b/scripts/base/frameworks/notice/actions/pp-alarms.bro index a385d8c626..02fe65e163 100644 --- a/scripts/base/frameworks/notice/actions/pp-alarms.bro +++ b/scripts/base/frameworks/notice/actions/pp-alarms.bro @@ -95,7 +95,7 @@ function pp_postprocessor(info: Log::RotationInfo): bool return T; } -event bro_init() +event zeek_init() { if ( ! want_pp() ) return; diff --git a/scripts/base/frameworks/notice/main.bro b/scripts/base/frameworks/notice/main.bro index 881e5d7467..5b2625e0db 100644 --- a/scripts/base/frameworks/notice/main.bro +++ b/scripts/base/frameworks/notice/main.bro @@ -385,7 +385,7 @@ function log_mailing_postprocessor(info: Log::RotationInfo): bool return T; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice, $path="notice"]); @@ -531,7 +531,7 @@ event Notice::begin_suppression(ts: time, suppress_for: interval, note: Type, suppressing[note, identifier] = suppress_until; } -event bro_init() +event zeek_init() { if ( ! Cluster::is_enabled() ) return; diff --git a/scripts/base/frameworks/notice/weird.bro b/scripts/base/frameworks/notice/weird.bro index c7a1f3aefb..d91a93ce27 100644 --- a/scripts/base/frameworks/notice/weird.bro +++ b/scripts/base/frameworks/notice/weird.bro @@ -296,7 +296,7 @@ const notice_actions = { ACTION_NOTICE_ONCE, }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Weird::LOG, [$columns=Info, $ev=log_weird, $path="weird"]); } diff --git a/scripts/base/frameworks/openflow/cluster.bro b/scripts/base/frameworks/openflow/cluster.bro index 9ae4274bb7..6ff005b877 100644 --- a/scripts/base/frameworks/openflow/cluster.bro +++ b/scripts/base/frameworks/openflow/cluster.bro @@ -15,7 +15,7 @@ export { @if ( Cluster::local_node_type() != Cluster::MANAGER ) # Workers need ability to forward commands to manager. -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, OpenFlow::cluster_flow_mod); Broker::auto_publish(Cluster::manager_topic, OpenFlow::cluster_flow_clear); diff --git a/scripts/base/frameworks/openflow/plugins/log.bro b/scripts/base/frameworks/openflow/plugins/log.bro index 2fd961cd4f..7f1ecf86ea 100644 --- a/scripts/base/frameworks/openflow/plugins/log.bro +++ b/scripts/base/frameworks/openflow/plugins/log.bro @@ -46,7 +46,7 @@ export { global log_openflow: event(rec: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(OpenFlow::LOG, [$columns=Info, $ev=log_openflow, $path="openflow"]); } diff --git a/scripts/base/frameworks/packet-filter/main.bro b/scripts/base/frameworks/packet-filter/main.bro index 9657f14c44..c06e801710 100644 --- a/scripts/base/frameworks/packet-filter/main.bro +++ b/scripts/base/frameworks/packet-filter/main.bro @@ -157,7 +157,7 @@ event filter_change_tracking() schedule 5min { filter_change_tracking() }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(PacketFilter::LOG, [$columns=Info, $path="packet_filter"]); @@ -175,7 +175,7 @@ event bro_init() &priority=5 } } -event bro_init() &priority=-5 +event zeek_init() &priority=-5 { install(); diff --git a/scripts/base/frameworks/packet-filter/netstats.bro b/scripts/base/frameworks/packet-filter/netstats.bro index 14545243d2..48b157b3eb 100644 --- a/scripts/base/frameworks/packet-filter/netstats.bro +++ b/scripts/base/frameworks/packet-filter/netstats.bro @@ -33,7 +33,7 @@ event net_stats_update(last_stat: NetStats) schedule stats_collection_interval { net_stats_update(ns) }; } -event bro_init() +event zeek_init() { # Since this currently only calculates packet drops, let's skip the stats # collection if reading traces. diff --git a/scripts/base/frameworks/reporter/main.bro b/scripts/base/frameworks/reporter/main.bro index 8cba29bdc2..3d4107a80e 100644 --- a/scripts/base/frameworks/reporter/main.bro +++ b/scripts/base/frameworks/reporter/main.bro @@ -35,7 +35,7 @@ export { }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Reporter::LOG, [$columns=Info, $path="reporter"]); } diff --git a/scripts/base/frameworks/signatures/main.bro b/scripts/base/frameworks/signatures/main.bro index 70c446d046..da19416871 100644 --- a/scripts/base/frameworks/signatures/main.bro +++ b/scripts/base/frameworks/signatures/main.bro @@ -140,7 +140,7 @@ global count_per_orig: table[addr, string] of count global did_sig_log: set[string] &read_expire = 1 hr; -event bro_init() +event zeek_init() { Log::create_stream(Signatures::LOG, [$columns=Info, $ev=log_signature, $path="signatures"]); } diff --git a/scripts/base/frameworks/software/main.bro b/scripts/base/frameworks/software/main.bro index 068f34d1cf..291ca539a1 100644 --- a/scripts/base/frameworks/software/main.bro +++ b/scripts/base/frameworks/software/main.bro @@ -121,7 +121,7 @@ export { global register: event(info: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Software::LOG, [$columns=Info, $ev=log_software, $path="software"]); } diff --git a/scripts/base/frameworks/sumstats/cluster.bro b/scripts/base/frameworks/sumstats/cluster.bro index f92b4112ff..670ad86fe1 100644 --- a/scripts/base/frameworks/sumstats/cluster.bro +++ b/scripts/base/frameworks/sumstats/cluster.bro @@ -61,7 +61,7 @@ global recent_global_view_keys: set[string, Key] &create_expire=1min; @if ( Cluster::local_node_type() != Cluster::MANAGER ) -event bro_init() &priority=100 +event zeek_init() &priority=100 { Broker::auto_publish(Cluster::manager_topic, SumStats::cluster_send_result); Broker::auto_publish(Cluster::manager_topic, SumStats::cluster_key_intermediate_response); @@ -209,7 +209,7 @@ function request_key(ss_name: string, key: Key): Result @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() &priority=100 +event zeek_init() &priority=100 { Broker::auto_publish(Cluster::worker_topic, SumStats::cluster_ss_request); Broker::auto_publish(Cluster::worker_topic, SumStats::cluster_get_result); diff --git a/scripts/base/frameworks/sumstats/main.bro b/scripts/base/frameworks/sumstats/main.bro index a37877f7e8..a312377111 100644 --- a/scripts/base/frameworks/sumstats/main.bro +++ b/scripts/base/frameworks/sumstats/main.bro @@ -270,7 +270,7 @@ function add_observe_plugin_dependency(calc: Calculation, depends_on: Calculatio calc_deps[calc] += depends_on; } -event bro_init() &priority=100000 +event zeek_init() &priority=100000 { # Call all of the plugin registration hooks hook register_observe_plugins(); diff --git a/scripts/base/frameworks/tunnels/main.bro b/scripts/base/frameworks/tunnels/main.bro index f90616e38e..f72a7d3445 100644 --- a/scripts/base/frameworks/tunnels/main.bro +++ b/scripts/base/frameworks/tunnels/main.bro @@ -87,7 +87,7 @@ const teredo_ports = { 3544/udp }; const gtpv1_ports = { 2152/udp, 2123/udp }; redef likely_server_ports += { ayiya_ports, teredo_ports, gtpv1_ports, vxlan_ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Tunnel::LOG, [$columns=Info, $path="tunnel"]); diff --git a/scripts/base/misc/find-checksum-offloading.bro b/scripts/base/misc/find-checksum-offloading.bro index 334cf4a2db..1edd4f9799 100644 --- a/scripts/base/misc/find-checksum-offloading.bro +++ b/scripts/base/misc/find-checksum-offloading.bro @@ -62,7 +62,7 @@ event ChecksumOffloading::check() } } -event bro_init() +event zeek_init() { schedule check_interval { ChecksumOffloading::check() }; } @@ -81,7 +81,7 @@ event conn_weird(name: string, c: connection, addl: string) ++bad_udp_checksums; } -event bro_done() +event zeek_done() { event ChecksumOffloading::check(); } diff --git a/scripts/base/misc/find-filtered-trace.bro b/scripts/base/misc/find-filtered-trace.bro index a723b656a7..a756f78551 100644 --- a/scripts/base/misc/find-filtered-trace.bro +++ b/scripts/base/misc/find-filtered-trace.bro @@ -36,7 +36,7 @@ event connection_state_remove(c: connection) saw_tcp_conn_with_data = T; } -event bro_done() +event zeek_done() { if ( ! enable ) return; diff --git a/scripts/base/protocols/conn/main.bro b/scripts/base/protocols/conn/main.bro index e2209b6e22..77a9c63aac 100644 --- a/scripts/base/protocols/conn/main.bro +++ b/scripts/base/protocols/conn/main.bro @@ -155,7 +155,7 @@ redef record connection += { conn: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Conn::LOG, [$columns=Info, $ev=log_conn, $path="conn"]); } diff --git a/scripts/base/protocols/dce-rpc/main.bro b/scripts/base/protocols/dce-rpc/main.bro index 7013ae15e9..1b318265e8 100644 --- a/scripts/base/protocols/dce-rpc/main.bro +++ b/scripts/base/protocols/dce-rpc/main.bro @@ -59,7 +59,7 @@ redef record connection += { const ports = { 135/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DCE_RPC::LOG, [$columns=Info, $path="dce_rpc"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DCE_RPC, ports); diff --git a/scripts/base/protocols/dhcp/main.bro b/scripts/base/protocols/dhcp/main.bro index b31c623afa..20998c082c 100644 --- a/scripts/base/protocols/dhcp/main.bro +++ b/scripts/base/protocols/dhcp/main.bro @@ -117,14 +117,14 @@ redef record Info += { const ports = { 67/udp, 68/udp, 4011/udp }; redef likely_server_ports += { 67/udp }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DHCP::LOG, [$columns=Info, $ev=log_dhcp, $path="dhcp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, ports); } @if ( Cluster::is_enabled() ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, DHCP::aggregate_msgs); } @@ -264,7 +264,7 @@ event dhcp_message(c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP:: event DHCP::aggregate_msgs(network_time(), c$id, c$uid, is_orig, msg, options); } -event bro_done() &priority=-5 +event zeek_done() &priority=-5 { # Log any remaining data that hasn't already been logged! for ( i in DHCP::join_data ) diff --git a/scripts/base/protocols/dnp3/main.bro b/scripts/base/protocols/dnp3/main.bro index 35dd012d75..184816c59f 100644 --- a/scripts/base/protocols/dnp3/main.bro +++ b/scripts/base/protocols/dnp3/main.bro @@ -34,7 +34,7 @@ redef record connection += { const ports = { 20000/tcp , 20000/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DNP3::LOG, [$columns=Info, $ev=log_dnp3, $path="dnp3"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3_TCP, ports); diff --git a/scripts/base/protocols/dns/main.bro b/scripts/base/protocols/dns/main.bro index f8e655d826..8504d614f6 100644 --- a/scripts/base/protocols/dns/main.bro +++ b/scripts/base/protocols/dns/main.bro @@ -154,7 +154,7 @@ redef record connection += { const ports = { 53/udp, 53/tcp, 137/udp, 5353/udp, 5355/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DNS::LOG, [$columns=Info, $ev=log_dns, $path="dns"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DNS, ports); diff --git a/scripts/base/protocols/ftp/files.bro b/scripts/base/protocols/ftp/files.bro index e84eda7a5a..f2c2625bdb 100644 --- a/scripts/base/protocols/ftp/files.bro +++ b/scripts/base/protocols/ftp/files.bro @@ -45,7 +45,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_FTP_DATA, [$get_file_handle = FTP::get_file_handle, diff --git a/scripts/base/protocols/ftp/main.bro b/scripts/base/protocols/ftp/main.bro index 9b64345a12..78a4dbabff 100644 --- a/scripts/base/protocols/ftp/main.bro +++ b/scripts/base/protocols/ftp/main.bro @@ -50,7 +50,7 @@ redef record connection += { const ports = { 21/tcp, 2811/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(FTP::LOG, [$columns=Info, $ev=log_ftp, $path="ftp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_FTP, ports); diff --git a/scripts/base/protocols/http/files.bro b/scripts/base/protocols/http/files.bro index 078c6d2e66..a8a67762d4 100644 --- a/scripts/base/protocols/http/files.bro +++ b/scripts/base/protocols/http/files.bro @@ -48,7 +48,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_HTTP, [$get_file_handle = HTTP::get_file_handle, diff --git a/scripts/base/protocols/http/main.bro b/scripts/base/protocols/http/main.bro index ea86367bb1..ef0561efb4 100644 --- a/scripts/base/protocols/http/main.bro +++ b/scripts/base/protocols/http/main.bro @@ -139,7 +139,7 @@ const ports = { redef likely_server_ports += { ports }; # Initialize the HTTP logging stream and ports. -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(HTTP::LOG, [$columns=Info, $ev=log_http, $path="http"]); Analyzer::register_for_ports(Analyzer::ANALYZER_HTTP, ports); diff --git a/scripts/base/protocols/imap/main.bro b/scripts/base/protocols/imap/main.bro index 9f0305c80c..30bfeab229 100644 --- a/scripts/base/protocols/imap/main.bro +++ b/scripts/base/protocols/imap/main.bro @@ -4,7 +4,7 @@ module IMAP; const ports = { 143/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_IMAP, ports); } diff --git a/scripts/base/protocols/irc/files.bro b/scripts/base/protocols/irc/files.bro index 759acdca81..59b178f4df 100644 --- a/scripts/base/protocols/irc/files.bro +++ b/scripts/base/protocols/irc/files.bro @@ -23,7 +23,7 @@ function get_file_handle(c: connection, is_orig: bool): string return cat(Analyzer::ANALYZER_IRC_DATA, c$start_time, c$id, is_orig); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_IRC_DATA, [$get_file_handle = IRC::get_file_handle]); diff --git a/scripts/base/protocols/irc/main.bro b/scripts/base/protocols/irc/main.bro index c2de29da6a..85a8795e88 100644 --- a/scripts/base/protocols/irc/main.bro +++ b/scripts/base/protocols/irc/main.bro @@ -41,7 +41,7 @@ redef record connection += { const ports = { 6666/tcp, 6667/tcp, 6668/tcp, 6669/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(IRC::LOG, [$columns=Info, $ev=irc_log, $path="irc"]); Analyzer::register_for_ports(Analyzer::ANALYZER_IRC, ports); diff --git a/scripts/base/protocols/krb/files.bro b/scripts/base/protocols/krb/files.bro index 18ee4da83f..c7dde949f2 100644 --- a/scripts/base/protocols/krb/files.bro +++ b/scripts/base/protocols/krb/files.bro @@ -61,7 +61,7 @@ function describe_file(f: fa_file): string f$info$x509$certificate$issuer); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_KRB_TCP, [$get_file_handle = KRB::get_file_handle, diff --git a/scripts/base/protocols/krb/main.bro b/scripts/base/protocols/krb/main.bro index 076ea0e171..72103104d5 100644 --- a/scripts/base/protocols/krb/main.bro +++ b/scripts/base/protocols/krb/main.bro @@ -73,7 +73,7 @@ const tcp_ports = { 88/tcp }; const udp_ports = { 88/udp }; redef likely_server_ports += { tcp_ports, udp_ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_KRB, udp_ports); Analyzer::register_for_ports(Analyzer::ANALYZER_KRB_TCP, tcp_ports); diff --git a/scripts/base/protocols/modbus/main.bro b/scripts/base/protocols/modbus/main.bro index 5a30d170e5..d8866cefa1 100644 --- a/scripts/base/protocols/modbus/main.bro +++ b/scripts/base/protocols/modbus/main.bro @@ -32,7 +32,7 @@ redef record connection += { const ports = { 502/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Modbus::LOG, [$columns=Info, $ev=log_modbus, $path="modbus"]); Analyzer::register_for_ports(Analyzer::ANALYZER_MODBUS, ports); diff --git a/scripts/base/protocols/mysql/main.bro b/scripts/base/protocols/mysql/main.bro index e4ba07cbca..e4c76dd5bc 100644 --- a/scripts/base/protocols/mysql/main.bro +++ b/scripts/base/protocols/mysql/main.bro @@ -37,7 +37,7 @@ redef record connection += { const ports = { 1434/tcp, 3306/tcp }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(mysql::LOG, [$columns=Info, $ev=log_mysql, $path="mysql"]); Analyzer::register_for_ports(Analyzer::ANALYZER_MYSQL, ports); diff --git a/scripts/base/protocols/ntlm/main.bro b/scripts/base/protocols/ntlm/main.bro index 88a484e090..231f90473d 100644 --- a/scripts/base/protocols/ntlm/main.bro +++ b/scripts/base/protocols/ntlm/main.bro @@ -42,7 +42,7 @@ redef record connection += { ntlm: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NTLM::LOG, [$columns=Info, $path="ntlm"]); } diff --git a/scripts/base/protocols/radius/main.bro b/scripts/base/protocols/radius/main.bro index ea30b27911..69a05cc8b3 100644 --- a/scripts/base/protocols/radius/main.bro +++ b/scripts/base/protocols/radius/main.bro @@ -56,7 +56,7 @@ redef record connection += { const ports = { 1812/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(RADIUS::LOG, [$columns=Info, $ev=log_radius, $path="radius"]); Analyzer::register_for_ports(Analyzer::ANALYZER_RADIUS, ports); diff --git a/scripts/base/protocols/rdp/main.bro b/scripts/base/protocols/rdp/main.bro index 30d5764ce3..39c3ef8fd8 100644 --- a/scripts/base/protocols/rdp/main.bro +++ b/scripts/base/protocols/rdp/main.bro @@ -86,7 +86,7 @@ redef record connection += { const ports = { 3389/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(RDP::LOG, [$columns=RDP::Info, $ev=log_rdp, $path="rdp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_RDP, ports); diff --git a/scripts/base/protocols/rfb/main.bro b/scripts/base/protocols/rfb/main.bro index ff05063538..ae9d3ca508 100644 --- a/scripts/base/protocols/rfb/main.bro +++ b/scripts/base/protocols/rfb/main.bro @@ -76,7 +76,7 @@ redef record connection += { rfb: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(RFB::LOG, [$columns=Info, $ev=log_rfb, $path="rfb"]); } diff --git a/scripts/base/protocols/sip/main.bro b/scripts/base/protocols/sip/main.bro index 68ebb9b222..e0647e6494 100644 --- a/scripts/base/protocols/sip/main.bro +++ b/scripts/base/protocols/sip/main.bro @@ -98,7 +98,7 @@ redef record connection += { const ports = { 5060/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SIP::LOG, [$columns=Info, $ev=log_sip, $path="sip"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SIP, ports); diff --git a/scripts/base/protocols/smb/files.bro b/scripts/base/protocols/smb/files.bro index 5916624941..ac719d728f 100644 --- a/scripts/base/protocols/smb/files.bro +++ b/scripts/base/protocols/smb/files.bro @@ -46,7 +46,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_SMB, [$get_file_handle = SMB::get_file_handle, diff --git a/scripts/base/protocols/smb/main.bro b/scripts/base/protocols/smb/main.bro index 07225548be..5524bde4f0 100644 --- a/scripts/base/protocols/smb/main.bro +++ b/scripts/base/protocols/smb/main.bro @@ -177,7 +177,7 @@ redef record FileInfo += { const ports = { 139/tcp, 445/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SMB::FILES_LOG, [$columns=SMB::FileInfo, $path="smb_files"]); Log::create_stream(SMB::MAPPING_LOG, [$columns=SMB::TreeInfo, $path="smb_mapping"]); diff --git a/scripts/base/protocols/smtp/files.bro b/scripts/base/protocols/smtp/files.bro index bf410fa201..cb38c27c97 100644 --- a/scripts/base/protocols/smtp/files.bro +++ b/scripts/base/protocols/smtp/files.bro @@ -38,7 +38,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_SMTP, [$get_file_handle = SMTP::get_file_handle, diff --git a/scripts/base/protocols/smtp/main.bro b/scripts/base/protocols/smtp/main.bro index faa73d2412..b13bbadb8d 100644 --- a/scripts/base/protocols/smtp/main.bro +++ b/scripts/base/protocols/smtp/main.bro @@ -92,7 +92,7 @@ redef record connection += { const ports = { 25/tcp, 587/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SMTP::LOG, [$columns=SMTP::Info, $ev=log_smtp, $path="smtp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SMTP, ports); diff --git a/scripts/base/protocols/snmp/main.bro b/scripts/base/protocols/snmp/main.bro index ec45d59440..606d3e9c76 100644 --- a/scripts/base/protocols/snmp/main.bro +++ b/scripts/base/protocols/snmp/main.bro @@ -63,7 +63,7 @@ redef record connection += { const ports = { 161/udp, 162/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_SNMP, ports); Log::create_stream(SNMP::LOG, [$columns=SNMP::Info, $ev=log_snmp, $path="snmp"]); diff --git a/scripts/base/protocols/socks/main.bro b/scripts/base/protocols/socks/main.bro index 341b6bbc84..2ca9dfc175 100644 --- a/scripts/base/protocols/socks/main.bro +++ b/scripts/base/protocols/socks/main.bro @@ -47,7 +47,7 @@ export { const ports = { 1080/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SOCKS::LOG, [$columns=Info, $ev=log_socks, $path="socks"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SOCKS, ports); diff --git a/scripts/base/protocols/ssh/main.bro b/scripts/base/protocols/ssh/main.bro index 4452424512..2e70bc1aba 100644 --- a/scripts/base/protocols/ssh/main.bro +++ b/scripts/base/protocols/ssh/main.bro @@ -136,7 +136,7 @@ redef record connection += { const ports = { 22/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_SSH, ports); Log::create_stream(SSH::LOG, [$columns=Info, $ev=log_ssh, $path="ssh"]); diff --git a/scripts/base/protocols/ssl/files.bro b/scripts/base/protocols/ssl/files.bro index ae13147d8e..fd3080b47d 100644 --- a/scripts/base/protocols/ssl/files.bro +++ b/scripts/base/protocols/ssl/files.bro @@ -79,7 +79,7 @@ function describe_file(f: fa_file): string f$info$x509$certificate$issuer); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_SSL, [$get_file_handle = SSL::get_file_handle, diff --git a/scripts/base/protocols/ssl/main.bro b/scripts/base/protocols/ssl/main.bro index 8abb6e1d3f..42d3e2ed62 100644 --- a/scripts/base/protocols/ssl/main.bro +++ b/scripts/base/protocols/ssl/main.bro @@ -137,7 +137,7 @@ const dtls_ports = { 443/udp }; redef likely_server_ports += { ssl_ports, dtls_ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SSL::LOG, [$columns=Info, $ev=log_ssl, $path="ssl"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, ssl_ports); diff --git a/scripts/base/protocols/syslog/main.bro b/scripts/base/protocols/syslog/main.bro index 6e74760225..6b8cc7fb77 100644 --- a/scripts/base/protocols/syslog/main.bro +++ b/scripts/base/protocols/syslog/main.bro @@ -34,7 +34,7 @@ redef record connection += { const ports = { 514/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Syslog::LOG, [$columns=Info, $path="syslog"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SYSLOG, ports); diff --git a/scripts/base/protocols/xmpp/main.bro b/scripts/base/protocols/xmpp/main.bro index 3d7a4cbc37..587432561f 100644 --- a/scripts/base/protocols/xmpp/main.bro +++ b/scripts/base/protocols/xmpp/main.bro @@ -4,7 +4,7 @@ module XMPP; const ports = { 5222/tcp, 5269/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_XMPP, ports); } diff --git a/scripts/base/utils/exec.bro b/scripts/base/utils/exec.bro index 91053a1223..fe44853541 100644 --- a/scripts/base/utils/exec.bro +++ b/scripts/base/utils/exec.bro @@ -186,7 +186,7 @@ function run(cmd: Command): Result } } -event bro_done() +event zeek_done() { # We are punting here and just deleting any unprocessed files. for ( uid in pending_files ) diff --git a/scripts/base/utils/site.bro b/scripts/base/utils/site.bro index aa40e1b92b..541dcb3f9a 100644 --- a/scripts/base/utils/site.bro +++ b/scripts/base/utils/site.bro @@ -148,7 +148,7 @@ function get_emails(a: addr): string return fmt_email_string(find_all_emails(a)); } -event bro_init() &priority=10 +event zeek_init() &priority=10 { # Double backslashes are needed due to string parsing. local_dns_suffix_regex = set_to_regex(local_zones, "(^\\.?|\\.)(~~)$"); diff --git a/scripts/broxygen/__load__.bro b/scripts/broxygen/__load__.bro index 5d4ac5ea03..01f920407e 100644 --- a/scripts/broxygen/__load__.bro +++ b/scripts/broxygen/__load__.bro @@ -11,7 +11,7 @@ @load ./example.bro -event bro_init() +event zeek_init() { terminate(); } diff --git a/scripts/broxygen/example.bro b/scripts/broxygen/example.bro index 65cc5ff1c7..d241051b7d 100644 --- a/scripts/broxygen/example.bro +++ b/scripts/broxygen/example.bro @@ -189,6 +189,6 @@ type PrivateRecord: record { # Event handlers are also an implementation detail of a script, so they # don't show up anywhere in the generated documentation. -event bro_init() +event zeek_init() { } diff --git a/scripts/policy/files/x509/log-ocsp.bro b/scripts/policy/files/x509/log-ocsp.bro index e416535dd4..8cc9d5aef3 100644 --- a/scripts/policy/files/x509/log-ocsp.bro +++ b/scripts/policy/files/x509/log-ocsp.bro @@ -39,7 +39,7 @@ export { global log_ocsp: event(rec: Info); } -event bro_init() +event zeek_init() { Log::create_stream(LOG, [$columns=Info, $ev=log_ocsp, $path="ocsp"]); Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); diff --git a/scripts/policy/frameworks/control/controllee.bro b/scripts/policy/frameworks/control/controllee.bro index c3f08cda2b..89768ef997 100644 --- a/scripts/policy/frameworks/control/controllee.bro +++ b/scripts/policy/frameworks/control/controllee.bro @@ -12,7 +12,7 @@ module Control; -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { Broker::subscribe(Control::topic_prefix + "/" + Broker::node_id()); Broker::auto_publish(Control::topic_prefix + "/id_value_response", diff --git a/scripts/policy/frameworks/control/controller.bro b/scripts/policy/frameworks/control/controller.bro index b81ce4b2d6..6befe70fe8 100644 --- a/scripts/policy/frameworks/control/controller.bro +++ b/scripts/policy/frameworks/control/controller.bro @@ -12,7 +12,7 @@ module Control; # Do some sanity checking and rework the communication nodes. -event bro_init() &priority=5 +event zeek_init() &priority=5 { # We know that some command was given because this script wouldn't be # loaded if there wasn't so we can feel free to throw an error here and diff --git a/scripts/policy/frameworks/packet-filter/shunt.bro b/scripts/policy/frameworks/packet-filter/shunt.bro index 97ae0c792d..13ff27252c 100644 --- a/scripts/policy/frameworks/packet-filter/shunt.bro +++ b/scripts/policy/frameworks/packet-filter/shunt.bro @@ -76,7 +76,7 @@ function shunt_filters() PacketFilter::exclude("shunt_filters", filter); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { register_filter_plugin([ $func()={ return shunt_filters(); } diff --git a/scripts/policy/frameworks/software/vulnerable.bro b/scripts/policy/frameworks/software/vulnerable.bro index 92a6698af3..b8d8c43a12 100644 --- a/scripts/policy/frameworks/software/vulnerable.bro +++ b/scripts/policy/frameworks/software/vulnerable.bro @@ -117,7 +117,7 @@ function update_vulnerable_sw() event grab_vulnerable_versions(1); } -event bro_init() &priority=3 +event zeek_init() &priority=3 { update_vulnerable_sw(); } diff --git a/scripts/policy/integration/barnyard2/main.bro b/scripts/policy/integration/barnyard2/main.bro index 96c74043f7..7d0bb59d5a 100644 --- a/scripts/policy/integration/barnyard2/main.bro +++ b/scripts/policy/integration/barnyard2/main.bro @@ -24,7 +24,7 @@ export { global pid2cid: function(p: PacketID): conn_id; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Barnyard2::LOG, [$columns=Info, $path="barnyard2"]); } diff --git a/scripts/policy/misc/capture-loss.bro b/scripts/policy/misc/capture-loss.bro index 541f6577cc..302919597f 100644 --- a/scripts/policy/misc/capture-loss.bro +++ b/scripts/policy/misc/capture-loss.bro @@ -74,7 +74,7 @@ event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps: schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(LOG, [$columns=Info, $path="capture_loss"]); diff --git a/scripts/policy/misc/detect-traceroute/main.bro b/scripts/policy/misc/detect-traceroute/main.bro index 5cbb34e27e..8271277af6 100644 --- a/scripts/policy/misc/detect-traceroute/main.bro +++ b/scripts/policy/misc/detect-traceroute/main.bro @@ -53,7 +53,7 @@ export { global log_traceroute: event(rec: Traceroute::Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Traceroute::LOG, [$columns=Info, $ev=log_traceroute, $path="traceroute"]); diff --git a/scripts/policy/misc/load-balancing.bro b/scripts/policy/misc/load-balancing.bro index 40bbe238ca..62f352f12e 100644 --- a/scripts/policy/misc/load-balancing.bro +++ b/scripts/policy/misc/load-balancing.bro @@ -28,7 +28,7 @@ export { @if ( Cluster::is_enabled() ) -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( method != AUTO_BPF ) return; diff --git a/scripts/policy/misc/loaded-scripts.bro b/scripts/policy/misc/loaded-scripts.bro index bfc0aad114..fd616bba19 100644 --- a/scripts/policy/misc/loaded-scripts.bro +++ b/scripts/policy/misc/loaded-scripts.bro @@ -27,7 +27,7 @@ function get_indent(level: count): string return out; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(LoadedScripts::LOG, [$columns=Info, $path="loaded_scripts"]); } diff --git a/scripts/policy/misc/profiling.bro b/scripts/policy/misc/profiling.bro index 613e78f860..5a0dfe5fcf 100644 --- a/scripts/policy/misc/profiling.bro +++ b/scripts/policy/misc/profiling.bro @@ -12,7 +12,7 @@ redef profiling_interval = 15 secs; ## :bro:id:`profiling_interval`). redef expensive_profiling_multiple = 20; -event bro_init() +event zeek_init() { set_buf(profiling_file, F); } diff --git a/scripts/policy/misc/scan.bro b/scripts/policy/misc/scan.bro index d70f8f9e79..6468767674 100644 --- a/scripts/policy/misc/scan.bro +++ b/scripts/policy/misc/scan.bro @@ -51,7 +51,7 @@ export { global Scan::port_scan_policy: hook(scanner: addr, victim: addr, scanned_port: port); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="scan.addr.fail", $apply=set(SumStats::UNIQUE), $unique_max=double_to_count(addr_scan_threshold+2)]; SumStats::create([$name="addr-scan", diff --git a/scripts/policy/misc/stats.bro b/scripts/policy/misc/stats.bro index 0bbf5c8aac..9c4ae4e792 100644 --- a/scripts/policy/misc/stats.bro +++ b/scripts/policy/misc/stats.bro @@ -82,7 +82,7 @@ export { global log_stats: event(rec: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Stats::LOG, [$columns=Info, $ev=log_stats, $path="stats"]); } @@ -149,7 +149,7 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr schedule report_interval { check_stats(nettime, ns, cs, ps, es, rs, ts, fs, ds) }; } -event bro_init() +event zeek_init() { schedule report_interval { check_stats(network_time(), get_net_stats(), get_conn_stats(), get_proc_stats(), get_event_stats(), get_reassembler_stats(), get_timer_stats(), get_file_analysis_stats(), get_dns_stats()) }; } diff --git a/scripts/policy/misc/trim-trace-file.bro b/scripts/policy/misc/trim-trace-file.bro index 8f534ec005..2d78977d8c 100644 --- a/scripts/policy/misc/trim-trace-file.bro +++ b/scripts/policy/misc/trim-trace-file.bro @@ -30,7 +30,7 @@ event TrimTraceFile::go(first_trim: bool) schedule trim_interval { TrimTraceFile::go(F) }; } -event bro_init() +event zeek_init() { if ( trim_interval > 0 secs ) schedule trim_interval { TrimTraceFile::go(T) }; diff --git a/scripts/policy/misc/weird-stats.bro b/scripts/policy/misc/weird-stats.bro index ac0914d531..bc75e2057a 100644 --- a/scripts/policy/misc/weird-stats.bro +++ b/scripts/policy/misc/weird-stats.bro @@ -51,7 +51,7 @@ function weird_epoch_finished(ts: time) this_epoch_weirds = table(); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(WeirdStats::LOG, [$columns = Info, $ev = log_weird_stats, diff --git a/scripts/policy/protocols/conn/known-hosts.bro b/scripts/policy/protocols/conn/known-hosts.bro index ef78630c6a..493784a859 100644 --- a/scripts/policy/protocols/conn/known-hosts.bro +++ b/scripts/policy/protocols/conn/known-hosts.bro @@ -61,7 +61,7 @@ export { global log_known_hosts: event(rec: HostsInfo); } -event bro_init() +event zeek_init() { if ( ! Known::use_host_store ) return; @@ -145,7 +145,7 @@ event Known::host_found(info: HostsInfo) event known_host_add(info); } -event bro_init() +event zeek_init() { Log::create_stream(Known::HOSTS_LOG, [$columns=HostsInfo, $ev=log_known_hosts, $path="known_hosts"]); } diff --git a/scripts/policy/protocols/conn/known-services.bro b/scripts/policy/protocols/conn/known-services.bro index f9e129839d..63d9f7fa71 100644 --- a/scripts/policy/protocols/conn/known-services.bro +++ b/scripts/policy/protocols/conn/known-services.bro @@ -80,7 +80,7 @@ redef record connection += { }; -event bro_init() +event zeek_init() { if ( ! Known::use_service_store ) return; @@ -216,7 +216,7 @@ event connection_state_remove(c: connection) &priority=-5 known_services_done(c); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Known::SERVICES_LOG, [$columns=ServicesInfo, $ev=log_known_services, diff --git a/scripts/policy/protocols/ftp/detect-bruteforcing.bro b/scripts/policy/protocols/ftp/detect-bruteforcing.bro index eb70688d47..4ac7b61efc 100644 --- a/scripts/policy/protocols/ftp/detect-bruteforcing.bro +++ b/scripts/policy/protocols/ftp/detect-bruteforcing.bro @@ -25,7 +25,7 @@ export { } -event bro_init() +event zeek_init() { local r1: SumStats::Reducer = [$stream="ftp.failed_auth", $apply=set(SumStats::UNIQUE), $unique_max=double_to_count(bruteforce_threshold+2)]; SumStats::create([$name="ftp-detect-bruteforcing", diff --git a/scripts/policy/protocols/http/detect-sqli.bro b/scripts/policy/protocols/http/detect-sqli.bro index 01c98ba0d7..3ad9efbfe2 100644 --- a/scripts/policy/protocols/http/detect-sqli.bro +++ b/scripts/policy/protocols/http/detect-sqli.bro @@ -67,7 +67,7 @@ function format_sqli_samples(samples: vector of SumStats::Observation): string return ret; } -event bro_init() &priority=3 +event zeek_init() &priority=3 { # Add filters to the metrics so that the metrics framework knows how to # determine when it looks like an actual attack and how to respond when diff --git a/scripts/policy/protocols/modbus/known-masters-slaves.bro b/scripts/policy/protocols/modbus/known-masters-slaves.bro index a49e1f81e4..4ce56570d8 100644 --- a/scripts/policy/protocols/modbus/known-masters-slaves.bro +++ b/scripts/policy/protocols/modbus/known-masters-slaves.bro @@ -33,7 +33,7 @@ export { global log_known_modbus: event(rec: ModbusInfo); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Known::MODBUS_LOG, [$columns=ModbusInfo, $ev=log_known_modbus, $path="known_modbus"]); } diff --git a/scripts/policy/protocols/modbus/track-memmap.bro b/scripts/policy/protocols/modbus/track-memmap.bro index 9a6e49e214..da2be29745 100644 --- a/scripts/policy/protocols/modbus/track-memmap.bro +++ b/scripts/policy/protocols/modbus/track-memmap.bro @@ -52,7 +52,7 @@ redef record Modbus::Info += { track_address: count &default=0; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Modbus::REGISTER_CHANGE_LOG, [$columns=MemmapInfo, $path="modbus_register_change"]); } diff --git a/scripts/policy/protocols/smb/log-cmds.bro b/scripts/policy/protocols/smb/log-cmds.bro index 53e309c5ea..88108276dc 100644 --- a/scripts/policy/protocols/smb/log-cmds.bro +++ b/scripts/policy/protocols/smb/log-cmds.bro @@ -25,7 +25,7 @@ const deferred_logging_cmds: set[string] = { "TREE_CONNECT_ANDX", }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SMB::CMD_LOG, [$columns=SMB::CmdInfo, $path="smb_cmd"]); } diff --git a/scripts/policy/protocols/ssh/detect-bruteforcing.bro b/scripts/policy/protocols/ssh/detect-bruteforcing.bro index 55687e2afd..208f3db04c 100644 --- a/scripts/policy/protocols/ssh/detect-bruteforcing.bro +++ b/scripts/policy/protocols/ssh/detect-bruteforcing.bro @@ -39,7 +39,7 @@ export { const ignore_guessers: table[subnet] of subnet &redef; } -event bro_init() +event zeek_init() { local r1: SumStats::Reducer = [$stream="ssh.login.failure", $apply=set(SumStats::SUM, SumStats::SAMPLE), $num_samples=5]; SumStats::create([$name="detect-ssh-bruteforcing", diff --git a/scripts/policy/protocols/ssl/heartbleed.bro b/scripts/policy/protocols/ssl/heartbleed.bro index ae4395289d..483c1f4ce1 100644 --- a/scripts/policy/protocols/ssl/heartbleed.bro +++ b/scripts/policy/protocols/ssl/heartbleed.bro @@ -45,7 +45,7 @@ type min_length: record { global min_lengths: vector of min_length = vector(); global min_lengths_tls11: vector of min_length = vector(); -event bro_init() +event zeek_init() { # Minimum length a heartbeat packet must have for different cipher suites. # Note - tls 1.1f and 1.0 have different lengths :( diff --git a/scripts/policy/protocols/ssl/known-certs.bro b/scripts/policy/protocols/ssl/known-certs.bro index 63a371b3e1..3841b77d87 100644 --- a/scripts/policy/protocols/ssl/known-certs.bro +++ b/scripts/policy/protocols/ssl/known-certs.bro @@ -72,7 +72,7 @@ export { global log_known_certs: event(rec: CertsInfo); } -event bro_init() +event zeek_init() { if ( ! Known::use_cert_store ) return; @@ -193,7 +193,7 @@ event ssl_established(c: connection) &priority=3 event Known::cert_found(info, hash); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Known::CERTS_LOG, [$columns=CertsInfo, $ev=log_known_certs, $path="known_certs"]); } diff --git a/scripts/policy/protocols/ssl/log-hostcerts-only.bro b/scripts/policy/protocols/ssl/log-hostcerts-only.bro index 258820664f..3aefac088a 100644 --- a/scripts/policy/protocols/ssl/log-hostcerts-only.bro +++ b/scripts/policy/protocols/ssl/log-hostcerts-only.bro @@ -31,7 +31,7 @@ function host_certs_only(rec: X509::Info): bool return rec$logcert; } -event bro_init() &priority=2 +event zeek_init() &priority=2 { local f = Log::get_filter(X509::LOG, "default"); Log::remove_filter(X509::LOG, "default"); # disable default logging diff --git a/scripts/policy/protocols/ssl/validate-certs.bro b/scripts/policy/protocols/ssl/validate-certs.bro index bd76daeceb..6a85627b3c 100644 --- a/scripts/policy/protocols/ssl/validate-certs.bro +++ b/scripts/policy/protocols/ssl/validate-certs.bro @@ -62,7 +62,7 @@ export { global intermediate_cache: table[string] of vector of opaque of x509; @if ( Cluster::is_enabled() ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, SSL::intermediate_add); Broker::auto_publish(Cluster::manager_topic, SSL::new_intermediate); diff --git a/scripts/policy/protocols/ssl/validate-sct.bro b/scripts/policy/protocols/ssl/validate-sct.bro index 4d79bfd7ad..b4db3666eb 100644 --- a/scripts/policy/protocols/ssl/validate-sct.bro +++ b/scripts/policy/protocols/ssl/validate-sct.bro @@ -69,7 +69,7 @@ export { global recently_validated_scts: table[string] of bool = table() &read_expire=5mins &redef; -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); } diff --git a/scripts/policy/tuning/defaults/warnings.bro b/scripts/policy/tuning/defaults/warnings.bro index cedc3d62ad..6c31e82d4e 100644 --- a/scripts/policy/tuning/defaults/warnings.bro +++ b/scripts/policy/tuning/defaults/warnings.bro @@ -4,7 +4,7 @@ @load base/utils/site -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { if ( |Site::local_nets| == 0 ) print "WARNING: No Site::local_nets have been defined. It's usually a good idea to define your local networks."; diff --git a/src/Net.cc b/src/Net.cc index d6cb6632b2..b61d365a2a 100644 --- a/src/Net.cc +++ b/src/Net.cc @@ -188,7 +188,7 @@ void net_init(name_list& interfaces, name_list& readfiles, else // have_pending_timers = 1, possibly. We don't set // that here, though, because at this point we don't know - // whether the user's bro_init() event will indeed set + // whether the user's zeek_init() event will indeed set // a timer. reading_traces = reading_live = 0; diff --git a/src/Val.cc b/src/Val.cc index b55a9090d3..340cef6bb5 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -2319,7 +2319,7 @@ void TableVal::DoExpire(double t) if ( v->ExpireAccessTime() == 0 ) { // This happens when we insert val while network_time - // hasn't been initialized yet (e.g. in bro_init()), and + // hasn't been initialized yet (e.g. in zeek_init()), and // also when bro_start_network_time hasn't been initialized // (e.g. before first packet). The expire_access_time is // correct, so we just need to wait. diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc index 1546f846e5..c7e156b41e 100644 --- a/src/analyzer/Manager.cc +++ b/src/analyzer/Manager.cc @@ -113,7 +113,7 @@ void Manager::InitPostScript() void Manager::DumpDebug() { #ifdef DEBUG - DBG_LOG(DBG_ANALYZER, "Available analyzers after bro_init():"); + DBG_LOG(DBG_ANALYZER, "Available analyzers after zeek_init():"); list all_analyzers = GetComponents(); for ( list::const_iterator i = all_analyzers.begin(); i != all_analyzers.end(); ++i ) DBG_LOG(DBG_ANALYZER, " %s (%s)", (*i)->Name().c_str(), diff --git a/src/analyzer/Manager.h b/src/analyzer/Manager.h index 7f58a45cbf..8f6d982394 100644 --- a/src/analyzer/Manager.h +++ b/src/analyzer/Manager.h @@ -78,10 +78,10 @@ public: /** * Dumps out the state of all registered analyzers to the \c analyzer - * debug stream. Should be called only after any \c bro_init events + * debug stream. Should be called only after any \c zeek_init events * have executed to ensure that any of their changes are applied. */ - void DumpDebug(); // Called after bro_init() events. + void DumpDebug(); // Called after zeek_init() events. /** * Enables an analyzer type. Only enabled analyzers will be diff --git a/src/analyzer/protocol/tcp/events.bif b/src/analyzer/protocol/tcp/events.bif index d93ebe4819..3e053458ea 100644 --- a/src/analyzer/protocol/tcp/events.bif +++ b/src/analyzer/protocol/tcp/events.bif @@ -151,7 +151,7 @@ event connection_reset%(c: connection%); ## connection_first_ACK connection_half_finished connection_partial_close ## connection_rejected connection_reset connection_reused connection_state_remove ## connection_status_update connection_timeout scheduled_analyzer_applied -## new_connection new_connection_contents partial_connection bro_done +## new_connection new_connection_contents partial_connection zeek_done event connection_pending%(c: connection%); ## Generated for a SYN packet. Bro raises this event for every SYN packet seen diff --git a/src/bro.bif b/src/bro.bif index 96419ab83d..4440f823c7 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -2994,8 +2994,8 @@ function uuid_to_string%(uuid: string%): string ## ## .. note:: ## -## This function must be called at Bro startup time, e.g., in the event -## :bro:id:`bro_init`. +## This function must be called at Zeek startup time, e.g., in the event +## :bro:id:`zeek_init`. function merge_pattern%(p1: pattern, p2: pattern%): pattern &deprecated %{ RE_Matcher* re = new RE_Matcher(); @@ -3061,8 +3061,8 @@ function convert_for_pattern%(s: string%): string ## ## .. note:: ## -## This function must be called at Bro startup time, e.g., in the event -## :bro:id:`bro_init`. +## This function must be called at Zeek startup time, e.g., in the event +## :bro:id:`zeek_init`. function string_to_pattern%(s: string, convert: bool%): pattern %{ const char* ss = (const char*) (s->Bytes()); @@ -4953,7 +4953,7 @@ function enable_communication%(%): any &deprecated %{ if ( bro_start_network_time != 0.0 ) { - builtin_error("communication must be enabled in bro_init"); + builtin_error("communication must be enabled in zeek_init"); return 0; } diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index d31198ced7..ec69308790 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -138,7 +138,7 @@ Manager::Manager(bool arg_reading_pcaps) { bound_port = 0; reading_pcaps = arg_reading_pcaps; - after_bro_init = false; + after_zeek_init = false; peer_count = 0; log_topic_func = nullptr; vector_of_data_type = nullptr; @@ -772,7 +772,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame) bool Manager::Subscribe(const string& topic_prefix) { DBG_LOG(DBG_BROKER, "Subscribing to topic prefix %s", topic_prefix.c_str()); - bstate->subscriber.add_topic(topic_prefix, ! after_bro_init); + bstate->subscriber.add_topic(topic_prefix, ! after_zeek_init); return true; } @@ -799,7 +799,7 @@ bool Manager::Unsubscribe(const string& topic_prefix) } DBG_LOG(DBG_BROKER, "Unsubscribing from topic prefix %s", topic_prefix.c_str()); - bstate->subscriber.remove_topic(topic_prefix, ! after_bro_init); + bstate->subscriber.remove_topic(topic_prefix, ! after_zeek_init); return true; } diff --git a/src/broker/Manager.h b/src/broker/Manager.h index 87aba80058..a0520698da 100644 --- a/src/broker/Manager.h +++ b/src/broker/Manager.h @@ -66,8 +66,8 @@ public: */ void InitPostScript(); - void BroInitDone() - { after_bro_init = true; } + void ZeekInitDone() + { after_zeek_init = true; } /** * Shuts Broker down at termination. @@ -380,7 +380,7 @@ private: uint16_t bound_port; bool reading_pcaps; - bool after_bro_init; + bool after_zeek_init; int peer_count; Func* log_topic_func; diff --git a/src/event.bif b/src/event.bif index ae00c9b653..4585003090 100644 --- a/src/event.bif +++ b/src/event.bif @@ -30,36 +30,46 @@ # # - .. todo:: -## Generated at Bro initialization time. The event engine generates this +## Generated at Zeek initialization time. The event engine generates this ## event just before normal input processing begins. It can be used to execute -## one-time initialization code at startup. At the time a handler runs, Bro will +## one-time initialization code at startup. At the time a handler runs, Zeek will ## have executed any global initializations and statements. ## -## .. bro:see:: bro_done +## .. bro:see:: zeek_done ## ## .. note:: ## -## When a ``bro_init`` handler executes, Bro has not yet seen any input +## When a ``zeek_init`` handler executes, Zeek has not yet seen any input ## packets and therefore :bro:id:`network_time` is not initialized yet. An -## artifact of that is that any timer installed in a ``bro_init`` handler +## artifact of that is that any timer installed in a ``zeek_init`` handler ## will fire immediately with the first packet. The standard way to work ## around that is to ignore the first time the timer fires and immediately ## reschedule. ## -event bro_init%(%); +event zeek_init%(%); -## Generated at Bro termination time. The event engine generates this event when -## Bro is about to terminate, either due to having exhausted reading its input -## trace file(s), receiving a termination signal, or because Bro was run without +## Deprecated synonym for ``zeek_init``. +## +## .. bro:see: zeek_init +event bro_init%(%) &deprecated; + +## Generated at Zeek termination time. The event engine generates this event when +## Zeek is about to terminate, either due to having exhausted reading its input +## trace file(s), receiving a termination signal, or because Zeek was run without ## a network input source and has finished executing any global statements. ## -## .. bro:see:: bro_init +## .. bro:see:: zeek_init ## ## .. note:: ## -## If Bro terminates due to an invocation of :bro:id:`exit`, then this event +## If Zeek terminates due to an invocation of :bro:id:`exit`, then this event ## is not generated. -event bro_done%(%); +event zeek_done%(%); + +## Deprecated synonym for ``zeek_done``. +## +## .. bro:see: zeek_done +event bro_done%(%) &deprecated; ## Generated for every new connection. This event is raised with the first ## packet of a previously unknown connection. Bro uses a flow-based definition diff --git a/src/main.cc b/src/main.cc index 1116b8c331..e7ff3c0655 100644 --- a/src/main.cc +++ b/src/main.cc @@ -339,9 +339,9 @@ void terminate_bro() brofiler.WriteStats(); - EventHandlerPtr bro_done = internal_handler("bro_done"); - if ( bro_done ) - mgr.QueueEvent(bro_done, new val_list); + EventHandlerPtr zeek_done = internal_handler("zeek_done"); + if ( zeek_done ) + mgr.QueueEvent(zeek_done, new val_list); timer_mgr->Expire(); mgr.Drain(); @@ -1136,9 +1136,9 @@ int main(int argc, char** argv) // we don't have any other source for it. net_update_time(current_time()); - EventHandlerPtr bro_init = internal_handler("bro_init"); - if ( bro_init ) //### this should be a function - mgr.QueueEvent(bro_init, new val_list); + EventHandlerPtr zeek_init = internal_handler("zeek_init"); + if ( zeek_init ) //### this should be a function + mgr.QueueEvent(zeek_init, new val_list); EventRegistry::string_list* dead_handlers = event_registry->UnusedHandlers(); @@ -1204,7 +1204,7 @@ int main(int argc, char** argv) if ( reporter->Errors() > 0 && ! getenv("ZEEK_ALLOW_INIT_ERRORS") ) reporter->FatalError("errors occurred while initializing"); - broker_mgr->BroInitDone(); + broker_mgr->ZeekInitDone(); analyzer_mgr->DumpDebug(); have_pending_timers = ! reading_traces && timer_mgr->Size() > 0; diff --git a/src/parse.y b/src/parse.y index c0980ce8de..22f33003cb 100644 --- a/src/parse.y +++ b/src/parse.y @@ -1171,6 +1171,12 @@ func_hdr: } | TOK_EVENT event_id func_params opt_attr { + // Gracefully handle the deprecation of bro_init and bro_done + if ( strncmp("bro_init", $2->Name(), 8) == 0 ) + $2 = lookup_ID("zeek_init", "GLOBAL"); + if ( strncmp("bro_done", $2->Name(), 8) == 0 ) + $2 = lookup_ID("zeek_done", "GLOBAL"); + begin_func($2, current_module.c_str(), FUNC_FLAVOR_EVENT, 0, $3, $4); $$ = $3; diff --git a/testing/btest/Baseline/language.zeek_init/out b/testing/btest/Baseline/language.zeek_init/out new file mode 100644 index 0000000000..31b2428745 --- /dev/null +++ b/testing/btest/Baseline/language.zeek_init/out @@ -0,0 +1,4 @@ +zeek init at priority 10! +bro init at priority 5! +zeek init at priority 0! +bro init at priority -10! diff --git a/testing/btest/language/zeek_init.bro b/testing/btest/language/zeek_init.bro new file mode 100644 index 0000000000..27f82d626c --- /dev/null +++ b/testing/btest/language/zeek_init.bro @@ -0,0 +1,44 @@ +# @TEST-EXEC: bro -b %INPUT >out +# @TEST-EXEC: btest-diff out + + +event zeek_init() &priority=10 + { + print "zeek_init at priority 10!"; + } + +event bro_init() &priority=5 + { + print "bro_init at priority 5!"; + } + +event zeek_init() &priority=0 + { + print "zeek_init at priority 0!"; + } + +event bro_init() &priority=-10 + { + print "bro_init at priority -10!"; + } + + +event zeek_done() &priority=10 + { + print "zeek_done at priority 10!"; + } + +event bro_done() &priority=5 + { + print "bro_done at priority 5!"; + } + +event zeek_done() &priority=0 + { + print "zeek_done at priority 0!"; + } + +event bro_done() &priority=-10 + { + print "bro_done at priority -10!"; + }