Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/robin/gh-3522-spicy-docs-state'

Browse source 
* origin/topic/robin/gh-3522-spicy-docs-state:
  Spicy: Document lifetime semantics of Zeek analyzers created from Spicy.
This commit is contained in:
Robin Sommer 2025-04-11 12:58:12 +02:00
commit a2f4588a15
No known key found for this signature in database
GPG key ID: D8187293B3FFE5D0
2 changed files with 13 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
doc

@ -1 +1 @@
Subproject commit a3858b7b808a1ce4cf5b8fc20ad8a7dabccd05de
Subproject commit 4a3d2d4c8df566eea1be8f9c9803dec81b500078

14
scripts/spicy/zeek.spicy
View file

@ -54,7 +54,7 @@ public type ProtocolHandle = __library_type("zeek::spicy::rt::ProtocolHandle");
## `protocol_begin` with same argument, and not closed with `protocol_handle_close`
## or `protocol_end`, no new analyzer will be added.
##
## See `protocol_handle_get_or_create` for the error semantics of this function.
## See `protocol_handle_get_or_create` for lifetime and error semantics.
##
## analyzer: type of analyzer to instantiate, specified through its Zeek-side
## name (similar to what Zeek's signature action `enable` takes)
@ -74,7 +74,7 @@ public function protocol_begin(analyzer: optional<string>, protocol: spicy::Prot
## `protocol_begin` with same argument, and not closed with `protocol_handle_close`
## or `protocol_end`, no new analyzer will be added.
##
## See `protocol_handle_get_or_create` for the error semantics of this function.
## See `protocol_handle_get_or_create` for lifetime and error semantics.
##
## protocol: the transport-layer protocol on which to perform protocol detection;
## only TCP is currently supported here
@ -92,6 +92,11 @@ public function protocol_begin(protocol: spicy::Protocol = spicy::Protocol::TCP)
## - creation of a child analyzer of the requested type was prevented by a
## previous call of `disable_analyzer` with `prevent=T`
##
## By default, any newly created child protocol analyzer will remain alive
## until Zeek expires the current connection's state. Alternatively, one
## can call `protocol_handle_close` or `protocol_end` to delete the analyzer
## earlier.
##
## analyzer: type of analyzer to get or instantiate, specified through its Zeek-side
## name (similar to what Zeek's signature action `enable` takes).
##
@ -147,6 +152,11 @@ public function protocol_handle_close(handle: ProtocolHandle): void &cxxname="ze
## Optionally, a mime type can be provided. It will be passed on to Zeek's file analysis framework.
## Optionally, a file ID can be provided. It will be passed on to Zeek's file analysis framework.
## Returns the Zeek-side file ID of the new file.
##
## This function creates a new Zeek file analyzer that will remain alive until
## either `file_end` gets called, or Zeek eventually expires the analyzer
## through a timeout. (As Zeek does not tie a file analyzer's lifetime to any
## connection, it may survive the termination of the current connection.)
public function file_begin(mime_type: optional<string> = Null, fuid: optional<string> = Null): string &cxxname="zeek::spicy::rt::file_begin";
## Returns the current file's FUID.