Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Spicy: Document lifetime semantics of Zeek analyzers created from Spicy.

Browse source 
Closes #3522.
This commit is contained in:
Robin Sommer 2025-04-10 10:11:30 +02:00
parent f74f5d2734
commit 9db73415cd
No known key found for this signature in database
GPG key ID: D8187293B3FFE5D0
2 changed files with 13 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
doc

@ -1 +1 @@
Subproject commit a3858b7b808a1ce4cf5b8fc20ad8a7dabccd05de Subproject commit eec55df87a5572c43e7365378d9c6b8082610aa4

14
scripts/spicy/zeek.spicy
View file

@ -54,7 +54,7 @@ public type ProtocolHandle = __library_type("zeek::spicy::rt::ProtocolHandle");
## `protocol_begin` with same argument, and not closed with `protocol_handle_close` ## `protocol_begin` with same argument, and not closed with `protocol_handle_close`
## or `protocol_end`, no new analyzer will be added. ## or `protocol_end`, no new analyzer will be added.
## ##
## See `protocol_handle_get_or_create` for the error semantics of this function. ## See `protocol_handle_get_or_create` for lifetime and error semantics.
## ##
## analyzer: type of analyzer to instantiate, specified through its Zeek-side ## analyzer: type of analyzer to instantiate, specified through its Zeek-side
## name (similar to what Zeek's signature action `enable` takes) ## name (similar to what Zeek's signature action `enable` takes)
@ -74,7 +74,7 @@ public function protocol_begin(analyzer: optional<string>, protocol: spicy::Prot
## `protocol_begin` with same argument, and not closed with `protocol_handle_close` ## `protocol_begin` with same argument, and not closed with `protocol_handle_close`
## or `protocol_end`, no new analyzer will be added. ## or `protocol_end`, no new analyzer will be added.
## ##
## See `protocol_handle_get_or_create` for the error semantics of this function. ## See `protocol_handle_get_or_create` for lifetime and error semantics.
## ##
## protocol: the transport-layer protocol on which to perform protocol detection; ## protocol: the transport-layer protocol on which to perform protocol detection;
## only TCP is currently supported here ## only TCP is currently supported here
@ -92,6 +92,11 @@ public function protocol_begin(protocol: spicy::Protocol = spicy::Protocol::TCP)
## - creation of a child analyzer of the requested type was prevented by a ## - creation of a child analyzer of the requested type was prevented by a
## previous call of `disable_analyzer` with `prevent=T` ## previous call of `disable_analyzer` with `prevent=T`
## ##
## By default, any newly created child protocol analyzer will remain alive
## until Zeek expires the current connection's state. Alternatively, one
## can call `protocol_handle_close` or `protocol_end` to delete the analyzer
## earlier.
##
## analyzer: type of analyzer to get or instantiate, specified through its Zeek-side ## analyzer: type of analyzer to get or instantiate, specified through its Zeek-side
## name (similar to what Zeek's signature action `enable` takes). ## name (similar to what Zeek's signature action `enable` takes).
## ##
@ -147,6 +152,11 @@ public function protocol_handle_close(handle: ProtocolHandle): void &cxxname="ze
## Optionally, a mime type can be provided. It will be passed on to Zeek's file analysis framework. ## Optionally, a mime type can be provided. It will be passed on to Zeek's file analysis framework.
## Optionally, a file ID can be provided. It will be passed on to Zeek's file analysis framework. ## Optionally, a file ID can be provided. It will be passed on to Zeek's file analysis framework.
## Returns the Zeek-side file ID of the new file. ## Returns the Zeek-side file ID of the new file.
##
## This function creates a new Zeek file analyzer that will remain alive until
## either `file_end` gets called, or Zeek eventually expires the analyzer
## through a timeout. (As Zeek does not tie a file analyzer's lifetime to any
## connection, it may survive the termination of the current connection.)
public function file_begin(mime_type: optional<string> = Null, fuid: optional<string> = Null): string &cxxname="zeek::spicy::rt::file_begin"; public function file_begin(mime_type: optional<string> = Null, fuid: optional<string> = Null): string &cxxname="zeek::spicy::rt::file_begin";
## Returns the current file's FUID. ## Returns the current file's FUID.