diff --git a/CHANGES b/CHANGES index 20d3933de3..b773789f55 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,12 @@ +2.6-236 | 2019-04-19 11:16:35 -0700 + + * Add zeek_init/zeek_done events and deprecate bro_init/bro_done (Seth Hall, Corelight) + + Any existing handlers for bro_init and bro_done will automatically alias + to the new zeek_init and zeek_done events such that code will not break, + but will emit a deprecation warning. + 2.6-232 | 2019-04-18 09:34:13 +0200 * Prevent topk_merge from crashing when second argument is empty set (Jeff Barber) diff --git a/NEWS b/NEWS index a1e04773ff..df9dca2229 100644 --- a/NEWS +++ b/NEWS @@ -176,6 +176,12 @@ Deprecated Functionality instead. The later will automatically return a value that is enclosed in double-quotes. +- The ``bro_init`` and ``bro_done`` events are now deprecated, use + ``zeek_init`` and ``zeek_done`` instead. Any existing handlers for + ``bro_init`` and ``bro_done`` will automatically alias to the new + ``zeek_init`` and ``zeek_done`` events such that existing code will + not break, but will emit a deprecation warning. + Bro 2.6 ======= diff --git a/VERSION b/VERSION index c3e7e724d5..d732c2900b 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-232 +2.6-236 diff --git a/aux/broctl b/aux/broctl index 65f213ff35..5698525ae4 160000 --- a/aux/broctl +++ b/aux/broctl @@ -1 +1 @@ -Subproject commit 65f213ff3573314ac8f7b33ff4b121d93fc883dc +Subproject commit 5698525ae41c397c18eba1d5350cca18fa081665 diff --git a/aux/broker b/aux/broker index e8f6d7fa95..1ab04b7bd8 160000 --- a/aux/broker +++ b/aux/broker @@ -1 +1 @@ -Subproject commit e8f6d7fa952c7d0bb9cb5f54e82806a17a9b85f3 +Subproject commit 1ab04b7bd893f65c1339b2ac92596dca6ed66412 diff --git a/doc b/doc index 9b556e5e71..5e02a297ee 160000 --- a/doc +++ b/doc @@ -1 +1 @@ -Subproject commit 9b556e5e71d0d8a5c2e7a1d4be4b308d887310f1 +Subproject commit 5e02a297eefe8740e8b84f7610fbf126af5c3475 diff --git a/scripts/base/files/extract/main.zeek b/scripts/base/files/extract/main.zeek index b2d1907e01..eaae44a089 100644 --- a/scripts/base/files/extract/main.zeek +++ b/scripts/base/files/extract/main.zeek @@ -75,7 +75,7 @@ event file_extraction_limit(f: fa_file, args: Files::AnalyzerArgs, limit: count, f$info$extracted_size = limit; } -event bro_init() &priority=10 +event zeek_init() &priority=10 { Files::register_analyzer_add_callback(Files::ANALYZER_EXTRACT, on_add); } diff --git a/scripts/base/files/pe/main.zeek b/scripts/base/files/pe/main.zeek index 9ef859d2fb..688c161177 100644 --- a/scripts/base/files/pe/main.zeek +++ b/scripts/base/files/pe/main.zeek @@ -55,7 +55,7 @@ redef record fa_file += { const pe_mime_types = { "application/x-dosexec" }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_for_mime_types(Files::ANALYZER_PE, pe_mime_types); Log::create_stream(LOG, [$columns=Info, $ev=log_pe, $path="pe"]); diff --git a/scripts/base/files/unified2/main.zeek b/scripts/base/files/unified2/main.zeek index 4670ff35c1..1a9841d5b1 100644 --- a/scripts/base/files/unified2/main.zeek +++ b/scripts/base/files/unified2/main.zeek @@ -193,7 +193,7 @@ event Input::end_of_data(name: string, source: string) start_watching(); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Unified2::LOG, [$columns=Info, $ev=log_unified2, $path="unified2"]); diff --git a/scripts/base/files/x509/main.zeek b/scripts/base/files/x509/main.zeek index b6fdde5494..e674ae8888 100644 --- a/scripts/base/files/x509/main.zeek +++ b/scripts/base/files/x509/main.zeek @@ -29,7 +29,7 @@ export { global log_x509: event(rec: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(X509::LOG, [$columns=Info, $ev=log_x509, $path="x509"]); diff --git a/scripts/base/frameworks/analyzer/main.zeek b/scripts/base/frameworks/analyzer/main.zeek index 39b0d573fd..57a602f308 100644 --- a/scripts/base/frameworks/analyzer/main.zeek +++ b/scripts/base/frameworks/analyzer/main.zeek @@ -135,7 +135,7 @@ export { global ports: table[Analyzer::Tag] of set[port]; -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( disable_all ) __disable_all_analyzers(); diff --git a/scripts/base/frameworks/broker/log.zeek b/scripts/base/frameworks/broker/log.zeek index 2461cb8d54..bd76684b74 100644 --- a/scripts/base/frameworks/broker/log.zeek +++ b/scripts/base/frameworks/broker/log.zeek @@ -30,7 +30,7 @@ export { }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Broker::LOG, [$columns=Info, $path="broker"]); } diff --git a/scripts/base/frameworks/broker/main.zeek b/scripts/base/frameworks/broker/main.zeek index 9be261eaf1..93ed69c3c5 100644 --- a/scripts/base/frameworks/broker/main.zeek +++ b/scripts/base/frameworks/broker/main.zeek @@ -298,7 +298,7 @@ export { ## Register interest in all peer event messages that use a certain topic ## prefix. Note that subscriptions may not be altered immediately after - ## calling (except during :bro:see:`bro_init`). + ## calling (except during :bro:see:`zeek_init`). ## ## topic_prefix: a prefix to match against remote message topics. ## e.g. an empty prefix matches everything and "a" matches @@ -309,7 +309,7 @@ export { ## Unregister interest in all peer event messages that use a topic prefix. ## Note that subscriptions may not be altered immediately after calling - ## (except during :bro:see:`bro_init`). + ## (except during :bro:see:`zeek_init`). ## ## topic_prefix: a prefix previously supplied to a successful call to ## :bro:see:`Broker::subscribe` or :bro:see:`Broker::forward`. diff --git a/scripts/base/frameworks/cluster/main.zeek b/scripts/base/frameworks/cluster/main.zeek index 2cb0401eea..08d48ac858 100644 --- a/scripts/base/frameworks/cluster/main.zeek +++ b/scripts/base/frameworks/cluster/main.zeek @@ -359,7 +359,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) &priority=1 } } -event bro_init() &priority=5 +event zeek_init() &priority=5 { # If a node is given, but it's an unknown name we need to fail. if ( node != "" && node !in nodes ) diff --git a/scripts/base/frameworks/cluster/pools.zeek b/scripts/base/frameworks/cluster/pools.zeek index 8f4e92b922..40f9a9cbf1 100644 --- a/scripts/base/frameworks/cluster/pools.zeek +++ b/scripts/base/frameworks/cluster/pools.zeek @@ -324,7 +324,7 @@ function mark_pool_node_dead(pool: Pool, name: string): bool return T; } -event bro_init() +event zeek_init() { worker_pool = register_pool(worker_pool_spec); proxy_pool = register_pool(proxy_pool_spec); @@ -344,8 +344,8 @@ function pool_sorter(a: Pool, b: Pool): int return strcmp(a$spec$topic, b$spec$topic); } -# Needs to execute before the bro_init in setup-connections -event bro_init() &priority=-5 +# Needs to execute before the zeek_init in setup-connections +event zeek_init() &priority=-5 { if ( ! Cluster::is_enabled() ) return; diff --git a/scripts/base/frameworks/cluster/setup-connections.zeek b/scripts/base/frameworks/cluster/setup-connections.zeek index a90081c639..004dd22f2a 100644 --- a/scripts/base/frameworks/cluster/setup-connections.zeek +++ b/scripts/base/frameworks/cluster/setup-connections.zeek @@ -42,7 +42,7 @@ function connect_peers_with_type(node_type: NodeType) } } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { if ( getenv("BROCTL_CHECK_CONFIG") != "" ) return; diff --git a/scripts/base/frameworks/config/input.zeek b/scripts/base/frameworks/config/input.zeek index 7c1f37567b..9796d69f57 100644 --- a/scripts/base/frameworks/config/input.zeek +++ b/scripts/base/frameworks/config/input.zeek @@ -34,7 +34,7 @@ event config_line(description: Input::EventDescription, tpe: Input::Event, p: Ev { } -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( Cluster::is_enabled() && Cluster::local_node_type() != Cluster::MANAGER ) return; diff --git a/scripts/base/frameworks/config/main.zeek b/scripts/base/frameworks/config/main.zeek index 2f9dbfc720..aacebbc530 100644 --- a/scripts/base/frameworks/config/main.zeek +++ b/scripts/base/frameworks/config/main.zeek @@ -150,7 +150,7 @@ function config_option_changed(ID: string, new_value: any, location: string): an return new_value; } -event bro_init() &priority=10 +event zeek_init() &priority=10 { Log::create_stream(LOG, [$columns=Info, $ev=log_config, $path="config"]); diff --git a/scripts/base/frameworks/config/weird.zeek b/scripts/base/frameworks/config/weird.zeek index bc311e3029..5e55b0b188 100644 --- a/scripts/base/frameworks/config/weird.zeek +++ b/scripts/base/frameworks/config/weird.zeek @@ -35,7 +35,7 @@ function weird_option_change_interval(ID: string, new_value: interval, location: return new_value; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Option::set_change_handler("Weird::sampling_whitelist", weird_option_change_sampling_whitelist, 5); Option::set_change_handler("Weird::sampling_threshold", weird_option_change_count, 5); diff --git a/scripts/base/frameworks/dpd/main.zeek b/scripts/base/frameworks/dpd/main.zeek index cce8b362d5..c6a3515bc3 100644 --- a/scripts/base/frameworks/dpd/main.zeek +++ b/scripts/base/frameworks/dpd/main.zeek @@ -39,7 +39,7 @@ redef record connection += { dpd: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DPD::LOG, [$columns=Info, $path="dpd"]); } diff --git a/scripts/base/frameworks/files/main.zeek b/scripts/base/frameworks/files/main.zeek index d3d37b30ab..fc75d68e8e 100644 --- a/scripts/base/frameworks/files/main.zeek +++ b/scripts/base/frameworks/files/main.zeek @@ -324,7 +324,7 @@ global mime_type_to_analyzers: table[string] of set[Files::Tag]; global analyzer_add_callbacks: table[Files::Tag] of function(f: fa_file, args: AnalyzerArgs) = table(); -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Files::LOG, [$columns=Info, $ev=log_files, $path="files"]); } diff --git a/scripts/base/frameworks/intel/cluster.zeek b/scripts/base/frameworks/intel/cluster.zeek index b71e8c47ea..2d51ffb200 100644 --- a/scripts/base/frameworks/intel/cluster.zeek +++ b/scripts/base/frameworks/intel/cluster.zeek @@ -16,7 +16,7 @@ redef have_full_data = F; @endif @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, remove_indicator); } @@ -67,7 +67,7 @@ event Intel::match_remote(s: Seen) &priority=5 @endif @if ( Cluster::local_node_type() == Cluster::WORKER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, match_remote); Broker::auto_publish(Cluster::manager_topic, remove_item); diff --git a/scripts/base/frameworks/intel/input.zeek b/scripts/base/frameworks/intel/input.zeek index aea3ac9a35..4dfa011fad 100644 --- a/scripts/base/frameworks/intel/input.zeek +++ b/scripts/base/frameworks/intel/input.zeek @@ -27,7 +27,7 @@ event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::insert(item); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( ! Cluster::is_enabled() || Cluster::local_node_type() == Cluster::MANAGER ) diff --git a/scripts/base/frameworks/intel/main.zeek b/scripts/base/frameworks/intel/main.zeek index 4bc3b296dd..f59323369d 100644 --- a/scripts/base/frameworks/intel/main.zeek +++ b/scripts/base/frameworks/intel/main.zeek @@ -223,7 +223,7 @@ type MinDataStore: record { global min_data_store: MinDataStore &redef; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(LOG, [$columns=Info, $ev=log_intel, $path="intel"]); } diff --git a/scripts/base/frameworks/logging/postprocessors/scp.zeek b/scripts/base/frameworks/logging/postprocessors/scp.zeek index d63520abe6..462cb86b20 100644 --- a/scripts/base/frameworks/logging/postprocessors/scp.zeek +++ b/scripts/base/frameworks/logging/postprocessors/scp.zeek @@ -2,7 +2,7 @@ ##! to a logging filter in order to automatically SCP (secure copy) ##! a log stream (or a subset of it) to a remote host at configurable ##! rotation time intervals. Generally, to use this functionality -##! you must handle the :bro:id:`bro_init` event and do the following +##! you must handle the :bro:id:`zeek_init` event and do the following ##! in your handler: ##! ##! 1) Create a new :bro:type:`Log::Filter` record that defines a name/path, diff --git a/scripts/base/frameworks/logging/postprocessors/sftp.zeek b/scripts/base/frameworks/logging/postprocessors/sftp.zeek index 8c77899864..803851261f 100644 --- a/scripts/base/frameworks/logging/postprocessors/sftp.zeek +++ b/scripts/base/frameworks/logging/postprocessors/sftp.zeek @@ -2,7 +2,7 @@ ##! to a logging filter in order to automatically SFTP ##! a log stream (or a subset of it) to a remote host at configurable ##! rotation time intervals. Generally, to use this functionality -##! you must handle the :bro:id:`bro_init` event and do the following +##! you must handle the :bro:id:`zeek_init` event and do the following ##! in your handler: ##! ##! 1) Create a new :bro:type:`Log::Filter` record that defines a name/path, diff --git a/scripts/base/frameworks/netcontrol/catch-and-release.zeek b/scripts/base/frameworks/netcontrol/catch-and-release.zeek index 79de7d9662..83d9e1d7af 100644 --- a/scripts/base/frameworks/netcontrol/catch-and-release.zeek +++ b/scripts/base/frameworks/netcontrol/catch-and-release.zeek @@ -163,7 +163,7 @@ export { # Set that is used to only send seen notifications to the master every ~30 seconds. global catch_release_recently_notified: set[addr] &create_expire=30secs; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::CATCH_RELEASE, [$columns=CatchReleaseInfo, $ev=log_netcontrol_catch_release, $path="netcontrol_catch_release"]); } @@ -227,13 +227,13 @@ global blocks: table[addr] of BlockInfo = {} @if ( Cluster::is_enabled() ) @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, NetControl::catch_release_block_new); Broker::auto_publish(Cluster::worker_topic, NetControl::catch_release_block_delete); } @else -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, NetControl::catch_release_add); Broker::auto_publish(Cluster::manager_topic, NetControl::catch_release_delete); diff --git a/scripts/base/frameworks/netcontrol/cluster.zeek b/scripts/base/frameworks/netcontrol/cluster.zeek index d70ab6d1c1..3fbd4cd6a1 100644 --- a/scripts/base/frameworks/netcontrol/cluster.zeek +++ b/scripts/base/frameworks/netcontrol/cluster.zeek @@ -17,7 +17,7 @@ export { } @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, NetControl::rule_added); Broker::auto_publish(Cluster::worker_topic, NetControl::rule_removed); @@ -28,7 +28,7 @@ event bro_init() Broker::auto_publish(Cluster::worker_topic, NetControl::rule_destroyed); } @else -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, NetControl::cluster_netcontrol_add_rule); Broker::auto_publish(Cluster::manager_topic, NetControl::cluster_netcontrol_remove_rule); diff --git a/scripts/base/frameworks/netcontrol/drop.zeek b/scripts/base/frameworks/netcontrol/drop.zeek index 8b31996057..40304e1187 100644 --- a/scripts/base/frameworks/netcontrol/drop.zeek +++ b/scripts/base/frameworks/netcontrol/drop.zeek @@ -55,7 +55,7 @@ export { global log_netcontrol_drop: event(rec: DropInfo); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::DROP, [$columns=DropInfo, $ev=log_netcontrol_drop, $path="netcontrol_drop"]); } diff --git a/scripts/base/frameworks/netcontrol/main.zeek b/scripts/base/frameworks/netcontrol/main.zeek index 110a0488dd..ee5f6a276c 100644 --- a/scripts/base/frameworks/netcontrol/main.zeek +++ b/scripts/base/frameworks/netcontrol/main.zeek @@ -262,7 +262,7 @@ export { ##### Plugin functions ## Function called by plugins once they finished their activation. After all - ## plugins defined in bro_init finished to activate, rules will start to be sent + ## plugins defined in zeek_init finished to activate, rules will start to be sent ## to the plugins. Rules that scripts try to set before the backends are ready ## will be discarded. global plugin_activated: function(p: PluginState); @@ -338,13 +338,13 @@ redef record Rule += { }; # Variable tracking the state of plugin activation. Once all plugins that -# have been added in bro_init are activated, this will switch to T and +# have been added in zeek_init are activated, this will switch to T and # the event NetControl::init_done will be raised. global plugins_active: bool = F; -# Set to true at the end of bro_init (with very low priority). +# Set to true at the end of zeek_init (with very low priority). # Used to track when plugin activation could potentially be finished -global bro_init_done: bool = F; +global zeek_init_done: bool = F; # The counters that are used to generate the rule and plugin IDs global rule_counter: count = 1; @@ -364,7 +364,7 @@ global rules_by_subnets: table[subnet] of set[string]; # There always only can be one rule of each type for one entity. global rule_entities: table[Entity, RuleType] of Rule; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::LOG, [$columns=Info, $ev=log_netcontrol, $path="netcontrol"]); } @@ -613,18 +613,18 @@ function plugin_activated(p: PluginState) plugin_ids[id]$_activated = T; log_msg("activation finished", p); - if ( bro_init_done ) + if ( zeek_init_done ) check_plugins(); } -event bro_init() &priority=-5 +event zeek_init() &priority=-5 { event NetControl::init(); } event NetControl::init() &priority=-20 { - bro_init_done = T; + zeek_init_done = T; check_plugins(); diff --git a/scripts/base/frameworks/netcontrol/shunt.zeek b/scripts/base/frameworks/netcontrol/shunt.zeek index 1275be1560..58923a0cb3 100644 --- a/scripts/base/frameworks/netcontrol/shunt.zeek +++ b/scripts/base/frameworks/netcontrol/shunt.zeek @@ -36,7 +36,7 @@ export { global log_netcontrol_shunt: event(rec: ShuntInfo); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NetControl::SHUNT, [$columns=ShuntInfo, $ev=log_netcontrol_shunt, $path="netcontrol_shunt"]); } diff --git a/scripts/base/frameworks/notice/actions/pp-alarms.zeek b/scripts/base/frameworks/notice/actions/pp-alarms.zeek index a385d8c626..02fe65e163 100644 --- a/scripts/base/frameworks/notice/actions/pp-alarms.zeek +++ b/scripts/base/frameworks/notice/actions/pp-alarms.zeek @@ -95,7 +95,7 @@ function pp_postprocessor(info: Log::RotationInfo): bool return T; } -event bro_init() +event zeek_init() { if ( ! want_pp() ) return; diff --git a/scripts/base/frameworks/notice/main.zeek b/scripts/base/frameworks/notice/main.zeek index 881e5d7467..5b2625e0db 100644 --- a/scripts/base/frameworks/notice/main.zeek +++ b/scripts/base/frameworks/notice/main.zeek @@ -385,7 +385,7 @@ function log_mailing_postprocessor(info: Log::RotationInfo): bool return T; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice, $path="notice"]); @@ -531,7 +531,7 @@ event Notice::begin_suppression(ts: time, suppress_for: interval, note: Type, suppressing[note, identifier] = suppress_until; } -event bro_init() +event zeek_init() { if ( ! Cluster::is_enabled() ) return; diff --git a/scripts/base/frameworks/notice/weird.zeek b/scripts/base/frameworks/notice/weird.zeek index c7a1f3aefb..d91a93ce27 100644 --- a/scripts/base/frameworks/notice/weird.zeek +++ b/scripts/base/frameworks/notice/weird.zeek @@ -296,7 +296,7 @@ const notice_actions = { ACTION_NOTICE_ONCE, }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Weird::LOG, [$columns=Info, $ev=log_weird, $path="weird"]); } diff --git a/scripts/base/frameworks/openflow/cluster.zeek b/scripts/base/frameworks/openflow/cluster.zeek index 9ae4274bb7..6ff005b877 100644 --- a/scripts/base/frameworks/openflow/cluster.zeek +++ b/scripts/base/frameworks/openflow/cluster.zeek @@ -15,7 +15,7 @@ export { @if ( Cluster::local_node_type() != Cluster::MANAGER ) # Workers need ability to forward commands to manager. -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, OpenFlow::cluster_flow_mod); Broker::auto_publish(Cluster::manager_topic, OpenFlow::cluster_flow_clear); diff --git a/scripts/base/frameworks/openflow/plugins/log.zeek b/scripts/base/frameworks/openflow/plugins/log.zeek index 2fd961cd4f..7f1ecf86ea 100644 --- a/scripts/base/frameworks/openflow/plugins/log.zeek +++ b/scripts/base/frameworks/openflow/plugins/log.zeek @@ -46,7 +46,7 @@ export { global log_openflow: event(rec: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(OpenFlow::LOG, [$columns=Info, $ev=log_openflow, $path="openflow"]); } diff --git a/scripts/base/frameworks/packet-filter/main.zeek b/scripts/base/frameworks/packet-filter/main.zeek index 9657f14c44..c06e801710 100644 --- a/scripts/base/frameworks/packet-filter/main.zeek +++ b/scripts/base/frameworks/packet-filter/main.zeek @@ -157,7 +157,7 @@ event filter_change_tracking() schedule 5min { filter_change_tracking() }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(PacketFilter::LOG, [$columns=Info, $path="packet_filter"]); @@ -175,7 +175,7 @@ event bro_init() &priority=5 } } -event bro_init() &priority=-5 +event zeek_init() &priority=-5 { install(); diff --git a/scripts/base/frameworks/packet-filter/netstats.zeek b/scripts/base/frameworks/packet-filter/netstats.zeek index 14545243d2..48b157b3eb 100644 --- a/scripts/base/frameworks/packet-filter/netstats.zeek +++ b/scripts/base/frameworks/packet-filter/netstats.zeek @@ -33,7 +33,7 @@ event net_stats_update(last_stat: NetStats) schedule stats_collection_interval { net_stats_update(ns) }; } -event bro_init() +event zeek_init() { # Since this currently only calculates packet drops, let's skip the stats # collection if reading traces. diff --git a/scripts/base/frameworks/reporter/main.zeek b/scripts/base/frameworks/reporter/main.zeek index ea97048049..39f0755325 100644 --- a/scripts/base/frameworks/reporter/main.zeek +++ b/scripts/base/frameworks/reporter/main.zeek @@ -35,7 +35,7 @@ export { }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Reporter::LOG, [$columns=Info, $path="reporter"]); } diff --git a/scripts/base/frameworks/signatures/main.zeek b/scripts/base/frameworks/signatures/main.zeek index 70c446d046..da19416871 100644 --- a/scripts/base/frameworks/signatures/main.zeek +++ b/scripts/base/frameworks/signatures/main.zeek @@ -140,7 +140,7 @@ global count_per_orig: table[addr, string] of count global did_sig_log: set[string] &read_expire = 1 hr; -event bro_init() +event zeek_init() { Log::create_stream(Signatures::LOG, [$columns=Info, $ev=log_signature, $path="signatures"]); } diff --git a/scripts/base/frameworks/software/main.zeek b/scripts/base/frameworks/software/main.zeek index 068f34d1cf..291ca539a1 100644 --- a/scripts/base/frameworks/software/main.zeek +++ b/scripts/base/frameworks/software/main.zeek @@ -121,7 +121,7 @@ export { global register: event(info: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Software::LOG, [$columns=Info, $ev=log_software, $path="software"]); } diff --git a/scripts/base/frameworks/sumstats/cluster.zeek b/scripts/base/frameworks/sumstats/cluster.zeek index f92b4112ff..670ad86fe1 100644 --- a/scripts/base/frameworks/sumstats/cluster.zeek +++ b/scripts/base/frameworks/sumstats/cluster.zeek @@ -61,7 +61,7 @@ global recent_global_view_keys: set[string, Key] &create_expire=1min; @if ( Cluster::local_node_type() != Cluster::MANAGER ) -event bro_init() &priority=100 +event zeek_init() &priority=100 { Broker::auto_publish(Cluster::manager_topic, SumStats::cluster_send_result); Broker::auto_publish(Cluster::manager_topic, SumStats::cluster_key_intermediate_response); @@ -209,7 +209,7 @@ function request_key(ss_name: string, key: Key): Result @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() &priority=100 +event zeek_init() &priority=100 { Broker::auto_publish(Cluster::worker_topic, SumStats::cluster_ss_request); Broker::auto_publish(Cluster::worker_topic, SumStats::cluster_get_result); diff --git a/scripts/base/frameworks/sumstats/main.zeek b/scripts/base/frameworks/sumstats/main.zeek index a37877f7e8..a312377111 100644 --- a/scripts/base/frameworks/sumstats/main.zeek +++ b/scripts/base/frameworks/sumstats/main.zeek @@ -270,7 +270,7 @@ function add_observe_plugin_dependency(calc: Calculation, depends_on: Calculatio calc_deps[calc] += depends_on; } -event bro_init() &priority=100000 +event zeek_init() &priority=100000 { # Call all of the plugin registration hooks hook register_observe_plugins(); diff --git a/scripts/base/frameworks/tunnels/main.zeek b/scripts/base/frameworks/tunnels/main.zeek index f90616e38e..f72a7d3445 100644 --- a/scripts/base/frameworks/tunnels/main.zeek +++ b/scripts/base/frameworks/tunnels/main.zeek @@ -87,7 +87,7 @@ const teredo_ports = { 3544/udp }; const gtpv1_ports = { 2152/udp, 2123/udp }; redef likely_server_ports += { ayiya_ports, teredo_ports, gtpv1_ports, vxlan_ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Tunnel::LOG, [$columns=Info, $path="tunnel"]); diff --git a/scripts/base/misc/find-checksum-offloading.zeek b/scripts/base/misc/find-checksum-offloading.zeek index 334cf4a2db..1edd4f9799 100644 --- a/scripts/base/misc/find-checksum-offloading.zeek +++ b/scripts/base/misc/find-checksum-offloading.zeek @@ -62,7 +62,7 @@ event ChecksumOffloading::check() } } -event bro_init() +event zeek_init() { schedule check_interval { ChecksumOffloading::check() }; } @@ -81,7 +81,7 @@ event conn_weird(name: string, c: connection, addl: string) ++bad_udp_checksums; } -event bro_done() +event zeek_done() { event ChecksumOffloading::check(); } diff --git a/scripts/base/misc/find-filtered-trace.zeek b/scripts/base/misc/find-filtered-trace.zeek index a723b656a7..a756f78551 100644 --- a/scripts/base/misc/find-filtered-trace.zeek +++ b/scripts/base/misc/find-filtered-trace.zeek @@ -36,7 +36,7 @@ event connection_state_remove(c: connection) saw_tcp_conn_with_data = T; } -event bro_done() +event zeek_done() { if ( ! enable ) return; diff --git a/scripts/base/protocols/conn/main.zeek b/scripts/base/protocols/conn/main.zeek index e2209b6e22..77a9c63aac 100644 --- a/scripts/base/protocols/conn/main.zeek +++ b/scripts/base/protocols/conn/main.zeek @@ -155,7 +155,7 @@ redef record connection += { conn: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Conn::LOG, [$columns=Info, $ev=log_conn, $path="conn"]); } diff --git a/scripts/base/protocols/dce-rpc/main.zeek b/scripts/base/protocols/dce-rpc/main.zeek index 7013ae15e9..1b318265e8 100644 --- a/scripts/base/protocols/dce-rpc/main.zeek +++ b/scripts/base/protocols/dce-rpc/main.zeek @@ -59,7 +59,7 @@ redef record connection += { const ports = { 135/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DCE_RPC::LOG, [$columns=Info, $path="dce_rpc"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DCE_RPC, ports); diff --git a/scripts/base/protocols/dhcp/main.zeek b/scripts/base/protocols/dhcp/main.zeek index b31c623afa..20998c082c 100644 --- a/scripts/base/protocols/dhcp/main.zeek +++ b/scripts/base/protocols/dhcp/main.zeek @@ -117,14 +117,14 @@ redef record Info += { const ports = { 67/udp, 68/udp, 4011/udp }; redef likely_server_ports += { 67/udp }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DHCP::LOG, [$columns=Info, $ev=log_dhcp, $path="dhcp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, ports); } @if ( Cluster::is_enabled() ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, DHCP::aggregate_msgs); } @@ -264,7 +264,7 @@ event dhcp_message(c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP:: event DHCP::aggregate_msgs(network_time(), c$id, c$uid, is_orig, msg, options); } -event bro_done() &priority=-5 +event zeek_done() &priority=-5 { # Log any remaining data that hasn't already been logged! for ( i in DHCP::join_data ) diff --git a/scripts/base/protocols/dnp3/main.zeek b/scripts/base/protocols/dnp3/main.zeek index 35dd012d75..184816c59f 100644 --- a/scripts/base/protocols/dnp3/main.zeek +++ b/scripts/base/protocols/dnp3/main.zeek @@ -34,7 +34,7 @@ redef record connection += { const ports = { 20000/tcp , 20000/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DNP3::LOG, [$columns=Info, $ev=log_dnp3, $path="dnp3"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3_TCP, ports); diff --git a/scripts/base/protocols/dns/main.zeek b/scripts/base/protocols/dns/main.zeek index f8e655d826..8504d614f6 100644 --- a/scripts/base/protocols/dns/main.zeek +++ b/scripts/base/protocols/dns/main.zeek @@ -154,7 +154,7 @@ redef record connection += { const ports = { 53/udp, 53/tcp, 137/udp, 5353/udp, 5355/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(DNS::LOG, [$columns=Info, $ev=log_dns, $path="dns"]); Analyzer::register_for_ports(Analyzer::ANALYZER_DNS, ports); diff --git a/scripts/base/protocols/ftp/files.zeek b/scripts/base/protocols/ftp/files.zeek index e84eda7a5a..f2c2625bdb 100644 --- a/scripts/base/protocols/ftp/files.zeek +++ b/scripts/base/protocols/ftp/files.zeek @@ -45,7 +45,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_FTP_DATA, [$get_file_handle = FTP::get_file_handle, diff --git a/scripts/base/protocols/ftp/main.zeek b/scripts/base/protocols/ftp/main.zeek index 9b64345a12..78a4dbabff 100644 --- a/scripts/base/protocols/ftp/main.zeek +++ b/scripts/base/protocols/ftp/main.zeek @@ -50,7 +50,7 @@ redef record connection += { const ports = { 21/tcp, 2811/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(FTP::LOG, [$columns=Info, $ev=log_ftp, $path="ftp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_FTP, ports); diff --git a/scripts/base/protocols/http/files.zeek b/scripts/base/protocols/http/files.zeek index 078c6d2e66..a8a67762d4 100644 --- a/scripts/base/protocols/http/files.zeek +++ b/scripts/base/protocols/http/files.zeek @@ -48,7 +48,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_HTTP, [$get_file_handle = HTTP::get_file_handle, diff --git a/scripts/base/protocols/http/main.zeek b/scripts/base/protocols/http/main.zeek index ea86367bb1..ef0561efb4 100644 --- a/scripts/base/protocols/http/main.zeek +++ b/scripts/base/protocols/http/main.zeek @@ -139,7 +139,7 @@ const ports = { redef likely_server_ports += { ports }; # Initialize the HTTP logging stream and ports. -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(HTTP::LOG, [$columns=Info, $ev=log_http, $path="http"]); Analyzer::register_for_ports(Analyzer::ANALYZER_HTTP, ports); diff --git a/scripts/base/protocols/imap/main.zeek b/scripts/base/protocols/imap/main.zeek index 9f0305c80c..30bfeab229 100644 --- a/scripts/base/protocols/imap/main.zeek +++ b/scripts/base/protocols/imap/main.zeek @@ -4,7 +4,7 @@ module IMAP; const ports = { 143/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_IMAP, ports); } diff --git a/scripts/base/protocols/irc/files.zeek b/scripts/base/protocols/irc/files.zeek index 759acdca81..59b178f4df 100644 --- a/scripts/base/protocols/irc/files.zeek +++ b/scripts/base/protocols/irc/files.zeek @@ -23,7 +23,7 @@ function get_file_handle(c: connection, is_orig: bool): string return cat(Analyzer::ANALYZER_IRC_DATA, c$start_time, c$id, is_orig); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_IRC_DATA, [$get_file_handle = IRC::get_file_handle]); diff --git a/scripts/base/protocols/irc/main.zeek b/scripts/base/protocols/irc/main.zeek index c2de29da6a..85a8795e88 100644 --- a/scripts/base/protocols/irc/main.zeek +++ b/scripts/base/protocols/irc/main.zeek @@ -41,7 +41,7 @@ redef record connection += { const ports = { 6666/tcp, 6667/tcp, 6668/tcp, 6669/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(IRC::LOG, [$columns=Info, $ev=irc_log, $path="irc"]); Analyzer::register_for_ports(Analyzer::ANALYZER_IRC, ports); diff --git a/scripts/base/protocols/krb/files.zeek b/scripts/base/protocols/krb/files.zeek index 18ee4da83f..c7dde949f2 100644 --- a/scripts/base/protocols/krb/files.zeek +++ b/scripts/base/protocols/krb/files.zeek @@ -61,7 +61,7 @@ function describe_file(f: fa_file): string f$info$x509$certificate$issuer); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_KRB_TCP, [$get_file_handle = KRB::get_file_handle, diff --git a/scripts/base/protocols/krb/main.zeek b/scripts/base/protocols/krb/main.zeek index 076ea0e171..72103104d5 100644 --- a/scripts/base/protocols/krb/main.zeek +++ b/scripts/base/protocols/krb/main.zeek @@ -73,7 +73,7 @@ const tcp_ports = { 88/tcp }; const udp_ports = { 88/udp }; redef likely_server_ports += { tcp_ports, udp_ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_KRB, udp_ports); Analyzer::register_for_ports(Analyzer::ANALYZER_KRB_TCP, tcp_ports); diff --git a/scripts/base/protocols/modbus/main.zeek b/scripts/base/protocols/modbus/main.zeek index 5a30d170e5..d8866cefa1 100644 --- a/scripts/base/protocols/modbus/main.zeek +++ b/scripts/base/protocols/modbus/main.zeek @@ -32,7 +32,7 @@ redef record connection += { const ports = { 502/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Modbus::LOG, [$columns=Info, $ev=log_modbus, $path="modbus"]); Analyzer::register_for_ports(Analyzer::ANALYZER_MODBUS, ports); diff --git a/scripts/base/protocols/mysql/main.zeek b/scripts/base/protocols/mysql/main.zeek index e4ba07cbca..e4c76dd5bc 100644 --- a/scripts/base/protocols/mysql/main.zeek +++ b/scripts/base/protocols/mysql/main.zeek @@ -37,7 +37,7 @@ redef record connection += { const ports = { 1434/tcp, 3306/tcp }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(mysql::LOG, [$columns=Info, $ev=log_mysql, $path="mysql"]); Analyzer::register_for_ports(Analyzer::ANALYZER_MYSQL, ports); diff --git a/scripts/base/protocols/ntlm/main.zeek b/scripts/base/protocols/ntlm/main.zeek index 88a484e090..231f90473d 100644 --- a/scripts/base/protocols/ntlm/main.zeek +++ b/scripts/base/protocols/ntlm/main.zeek @@ -42,7 +42,7 @@ redef record connection += { ntlm: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(NTLM::LOG, [$columns=Info, $path="ntlm"]); } diff --git a/scripts/base/protocols/radius/main.zeek b/scripts/base/protocols/radius/main.zeek index 7c4e721ed6..6cd69227c8 100644 --- a/scripts/base/protocols/radius/main.zeek +++ b/scripts/base/protocols/radius/main.zeek @@ -56,7 +56,7 @@ redef record connection += { const ports = { 1812/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(RADIUS::LOG, [$columns=Info, $ev=log_radius, $path="radius"]); Analyzer::register_for_ports(Analyzer::ANALYZER_RADIUS, ports); diff --git a/scripts/base/protocols/rdp/main.zeek b/scripts/base/protocols/rdp/main.zeek index 30d5764ce3..39c3ef8fd8 100644 --- a/scripts/base/protocols/rdp/main.zeek +++ b/scripts/base/protocols/rdp/main.zeek @@ -86,7 +86,7 @@ redef record connection += { const ports = { 3389/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(RDP::LOG, [$columns=RDP::Info, $ev=log_rdp, $path="rdp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_RDP, ports); diff --git a/scripts/base/protocols/rfb/main.zeek b/scripts/base/protocols/rfb/main.zeek index ff05063538..ae9d3ca508 100644 --- a/scripts/base/protocols/rfb/main.zeek +++ b/scripts/base/protocols/rfb/main.zeek @@ -76,7 +76,7 @@ redef record connection += { rfb: Info &optional; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(RFB::LOG, [$columns=Info, $ev=log_rfb, $path="rfb"]); } diff --git a/scripts/base/protocols/sip/main.zeek b/scripts/base/protocols/sip/main.zeek index 68ebb9b222..e0647e6494 100644 --- a/scripts/base/protocols/sip/main.zeek +++ b/scripts/base/protocols/sip/main.zeek @@ -98,7 +98,7 @@ redef record connection += { const ports = { 5060/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SIP::LOG, [$columns=Info, $ev=log_sip, $path="sip"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SIP, ports); diff --git a/scripts/base/protocols/smb/files.zeek b/scripts/base/protocols/smb/files.zeek index 5916624941..ac719d728f 100644 --- a/scripts/base/protocols/smb/files.zeek +++ b/scripts/base/protocols/smb/files.zeek @@ -46,7 +46,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_SMB, [$get_file_handle = SMB::get_file_handle, diff --git a/scripts/base/protocols/smb/main.zeek b/scripts/base/protocols/smb/main.zeek index 07225548be..5524bde4f0 100644 --- a/scripts/base/protocols/smb/main.zeek +++ b/scripts/base/protocols/smb/main.zeek @@ -177,7 +177,7 @@ redef record FileInfo += { const ports = { 139/tcp, 445/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SMB::FILES_LOG, [$columns=SMB::FileInfo, $path="smb_files"]); Log::create_stream(SMB::MAPPING_LOG, [$columns=SMB::TreeInfo, $path="smb_mapping"]); diff --git a/scripts/base/protocols/smtp/files.zeek b/scripts/base/protocols/smtp/files.zeek index bf410fa201..cb38c27c97 100644 --- a/scripts/base/protocols/smtp/files.zeek +++ b/scripts/base/protocols/smtp/files.zeek @@ -38,7 +38,7 @@ function describe_file(f: fa_file): string return ""; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_SMTP, [$get_file_handle = SMTP::get_file_handle, diff --git a/scripts/base/protocols/smtp/main.zeek b/scripts/base/protocols/smtp/main.zeek index faa73d2412..b13bbadb8d 100644 --- a/scripts/base/protocols/smtp/main.zeek +++ b/scripts/base/protocols/smtp/main.zeek @@ -92,7 +92,7 @@ redef record connection += { const ports = { 25/tcp, 587/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SMTP::LOG, [$columns=SMTP::Info, $ev=log_smtp, $path="smtp"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SMTP, ports); diff --git a/scripts/base/protocols/snmp/main.zeek b/scripts/base/protocols/snmp/main.zeek index ec45d59440..606d3e9c76 100644 --- a/scripts/base/protocols/snmp/main.zeek +++ b/scripts/base/protocols/snmp/main.zeek @@ -63,7 +63,7 @@ redef record connection += { const ports = { 161/udp, 162/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_SNMP, ports); Log::create_stream(SNMP::LOG, [$columns=SNMP::Info, $ev=log_snmp, $path="snmp"]); diff --git a/scripts/base/protocols/socks/main.zeek b/scripts/base/protocols/socks/main.zeek index 341b6bbc84..2ca9dfc175 100644 --- a/scripts/base/protocols/socks/main.zeek +++ b/scripts/base/protocols/socks/main.zeek @@ -47,7 +47,7 @@ export { const ports = { 1080/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SOCKS::LOG, [$columns=Info, $ev=log_socks, $path="socks"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SOCKS, ports); diff --git a/scripts/base/protocols/ssh/main.zeek b/scripts/base/protocols/ssh/main.zeek index 4452424512..2e70bc1aba 100644 --- a/scripts/base/protocols/ssh/main.zeek +++ b/scripts/base/protocols/ssh/main.zeek @@ -136,7 +136,7 @@ redef record connection += { const ports = { 22/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_SSH, ports); Log::create_stream(SSH::LOG, [$columns=Info, $ev=log_ssh, $path="ssh"]); diff --git a/scripts/base/protocols/ssl/files.zeek b/scripts/base/protocols/ssl/files.zeek index ae13147d8e..fd3080b47d 100644 --- a/scripts/base/protocols/ssl/files.zeek +++ b/scripts/base/protocols/ssl/files.zeek @@ -79,7 +79,7 @@ function describe_file(f: fa_file): string f$info$x509$certificate$issuer); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Files::register_protocol(Analyzer::ANALYZER_SSL, [$get_file_handle = SSL::get_file_handle, diff --git a/scripts/base/protocols/ssl/main.zeek b/scripts/base/protocols/ssl/main.zeek index 73a8639891..cc656d44b8 100644 --- a/scripts/base/protocols/ssl/main.zeek +++ b/scripts/base/protocols/ssl/main.zeek @@ -137,7 +137,7 @@ const dtls_ports = { 443/udp }; redef likely_server_ports += { ssl_ports, dtls_ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SSL::LOG, [$columns=Info, $ev=log_ssl, $path="ssl"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, ssl_ports); diff --git a/scripts/base/protocols/syslog/main.zeek b/scripts/base/protocols/syslog/main.zeek index 6e74760225..6b8cc7fb77 100644 --- a/scripts/base/protocols/syslog/main.zeek +++ b/scripts/base/protocols/syslog/main.zeek @@ -34,7 +34,7 @@ redef record connection += { const ports = { 514/udp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Syslog::LOG, [$columns=Info, $path="syslog"]); Analyzer::register_for_ports(Analyzer::ANALYZER_SYSLOG, ports); diff --git a/scripts/base/protocols/xmpp/main.zeek b/scripts/base/protocols/xmpp/main.zeek index 3d7a4cbc37..587432561f 100644 --- a/scripts/base/protocols/xmpp/main.zeek +++ b/scripts/base/protocols/xmpp/main.zeek @@ -4,7 +4,7 @@ module XMPP; const ports = { 5222/tcp, 5269/tcp }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_XMPP, ports); } diff --git a/scripts/base/utils/exec.zeek b/scripts/base/utils/exec.zeek index 91053a1223..fe44853541 100644 --- a/scripts/base/utils/exec.zeek +++ b/scripts/base/utils/exec.zeek @@ -186,7 +186,7 @@ function run(cmd: Command): Result } } -event bro_done() +event zeek_done() { # We are punting here and just deleting any unprocessed files. for ( uid in pending_files ) diff --git a/scripts/base/utils/site.zeek b/scripts/base/utils/site.zeek index aa40e1b92b..541dcb3f9a 100644 --- a/scripts/base/utils/site.zeek +++ b/scripts/base/utils/site.zeek @@ -148,7 +148,7 @@ function get_emails(a: addr): string return fmt_email_string(find_all_emails(a)); } -event bro_init() &priority=10 +event zeek_init() &priority=10 { # Double backslashes are needed due to string parsing. local_dns_suffix_regex = set_to_regex(local_zones, "(^\\.?|\\.)(~~)$"); diff --git a/scripts/broxygen/__load__.zeek b/scripts/broxygen/__load__.zeek index 51e119a2c6..ac9d2c008b 100644 --- a/scripts/broxygen/__load__.zeek +++ b/scripts/broxygen/__load__.zeek @@ -11,7 +11,7 @@ @load ./example.zeek -event bro_init() +event zeek_init() { terminate(); } diff --git a/scripts/broxygen/example.zeek b/scripts/broxygen/example.zeek index 65cc5ff1c7..d241051b7d 100644 --- a/scripts/broxygen/example.zeek +++ b/scripts/broxygen/example.zeek @@ -189,6 +189,6 @@ type PrivateRecord: record { # Event handlers are also an implementation detail of a script, so they # don't show up anywhere in the generated documentation. -event bro_init() +event zeek_init() { } diff --git a/scripts/policy/files/x509/log-ocsp.zeek b/scripts/policy/files/x509/log-ocsp.zeek index e416535dd4..8cc9d5aef3 100644 --- a/scripts/policy/files/x509/log-ocsp.zeek +++ b/scripts/policy/files/x509/log-ocsp.zeek @@ -39,7 +39,7 @@ export { global log_ocsp: event(rec: Info); } -event bro_init() +event zeek_init() { Log::create_stream(LOG, [$columns=Info, $ev=log_ocsp, $path="ocsp"]); Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); diff --git a/scripts/policy/frameworks/control/controllee.zeek b/scripts/policy/frameworks/control/controllee.zeek index c3f08cda2b..89768ef997 100644 --- a/scripts/policy/frameworks/control/controllee.zeek +++ b/scripts/policy/frameworks/control/controllee.zeek @@ -12,7 +12,7 @@ module Control; -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { Broker::subscribe(Control::topic_prefix + "/" + Broker::node_id()); Broker::auto_publish(Control::topic_prefix + "/id_value_response", diff --git a/scripts/policy/frameworks/control/controller.zeek b/scripts/policy/frameworks/control/controller.zeek index b81ce4b2d6..6befe70fe8 100644 --- a/scripts/policy/frameworks/control/controller.zeek +++ b/scripts/policy/frameworks/control/controller.zeek @@ -12,7 +12,7 @@ module Control; # Do some sanity checking and rework the communication nodes. -event bro_init() &priority=5 +event zeek_init() &priority=5 { # We know that some command was given because this script wouldn't be # loaded if there wasn't so we can feel free to throw an error here and diff --git a/scripts/policy/frameworks/packet-filter/shunt.zeek b/scripts/policy/frameworks/packet-filter/shunt.zeek index 97ae0c792d..13ff27252c 100644 --- a/scripts/policy/frameworks/packet-filter/shunt.zeek +++ b/scripts/policy/frameworks/packet-filter/shunt.zeek @@ -76,7 +76,7 @@ function shunt_filters() PacketFilter::exclude("shunt_filters", filter); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { register_filter_plugin([ $func()={ return shunt_filters(); } diff --git a/scripts/policy/frameworks/software/vulnerable.zeek b/scripts/policy/frameworks/software/vulnerable.zeek index 92a6698af3..b8d8c43a12 100644 --- a/scripts/policy/frameworks/software/vulnerable.zeek +++ b/scripts/policy/frameworks/software/vulnerable.zeek @@ -117,7 +117,7 @@ function update_vulnerable_sw() event grab_vulnerable_versions(1); } -event bro_init() &priority=3 +event zeek_init() &priority=3 { update_vulnerable_sw(); } diff --git a/scripts/policy/integration/barnyard2/main.zeek b/scripts/policy/integration/barnyard2/main.zeek index 96c74043f7..7d0bb59d5a 100644 --- a/scripts/policy/integration/barnyard2/main.zeek +++ b/scripts/policy/integration/barnyard2/main.zeek @@ -24,7 +24,7 @@ export { global pid2cid: function(p: PacketID): conn_id; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Barnyard2::LOG, [$columns=Info, $path="barnyard2"]); } diff --git a/scripts/policy/misc/capture-loss.zeek b/scripts/policy/misc/capture-loss.zeek index 541f6577cc..302919597f 100644 --- a/scripts/policy/misc/capture-loss.zeek +++ b/scripts/policy/misc/capture-loss.zeek @@ -74,7 +74,7 @@ event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps: schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(LOG, [$columns=Info, $path="capture_loss"]); diff --git a/scripts/policy/misc/detect-traceroute/main.zeek b/scripts/policy/misc/detect-traceroute/main.zeek index 5cbb34e27e..8271277af6 100644 --- a/scripts/policy/misc/detect-traceroute/main.zeek +++ b/scripts/policy/misc/detect-traceroute/main.zeek @@ -53,7 +53,7 @@ export { global log_traceroute: event(rec: Traceroute::Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Traceroute::LOG, [$columns=Info, $ev=log_traceroute, $path="traceroute"]); diff --git a/scripts/policy/misc/load-balancing.zeek b/scripts/policy/misc/load-balancing.zeek index 40bbe238ca..62f352f12e 100644 --- a/scripts/policy/misc/load-balancing.zeek +++ b/scripts/policy/misc/load-balancing.zeek @@ -28,7 +28,7 @@ export { @if ( Cluster::is_enabled() ) -event bro_init() &priority=5 +event zeek_init() &priority=5 { if ( method != AUTO_BPF ) return; diff --git a/scripts/policy/misc/loaded-scripts.zeek b/scripts/policy/misc/loaded-scripts.zeek index bfc0aad114..fd616bba19 100644 --- a/scripts/policy/misc/loaded-scripts.zeek +++ b/scripts/policy/misc/loaded-scripts.zeek @@ -27,7 +27,7 @@ function get_indent(level: count): string return out; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(LoadedScripts::LOG, [$columns=Info, $path="loaded_scripts"]); } diff --git a/scripts/policy/misc/profiling.zeek b/scripts/policy/misc/profiling.zeek index 613e78f860..5a0dfe5fcf 100644 --- a/scripts/policy/misc/profiling.zeek +++ b/scripts/policy/misc/profiling.zeek @@ -12,7 +12,7 @@ redef profiling_interval = 15 secs; ## :bro:id:`profiling_interval`). redef expensive_profiling_multiple = 20; -event bro_init() +event zeek_init() { set_buf(profiling_file, F); } diff --git a/scripts/policy/misc/scan.zeek b/scripts/policy/misc/scan.zeek index d70f8f9e79..6468767674 100644 --- a/scripts/policy/misc/scan.zeek +++ b/scripts/policy/misc/scan.zeek @@ -51,7 +51,7 @@ export { global Scan::port_scan_policy: hook(scanner: addr, victim: addr, scanned_port: port); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="scan.addr.fail", $apply=set(SumStats::UNIQUE), $unique_max=double_to_count(addr_scan_threshold+2)]; SumStats::create([$name="addr-scan", diff --git a/scripts/policy/misc/stats.zeek b/scripts/policy/misc/stats.zeek index 0bbf5c8aac..9c4ae4e792 100644 --- a/scripts/policy/misc/stats.zeek +++ b/scripts/policy/misc/stats.zeek @@ -82,7 +82,7 @@ export { global log_stats: event(rec: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Stats::LOG, [$columns=Info, $ev=log_stats, $path="stats"]); } @@ -149,7 +149,7 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr schedule report_interval { check_stats(nettime, ns, cs, ps, es, rs, ts, fs, ds) }; } -event bro_init() +event zeek_init() { schedule report_interval { check_stats(network_time(), get_net_stats(), get_conn_stats(), get_proc_stats(), get_event_stats(), get_reassembler_stats(), get_timer_stats(), get_file_analysis_stats(), get_dns_stats()) }; } diff --git a/scripts/policy/misc/trim-trace-file.zeek b/scripts/policy/misc/trim-trace-file.zeek index 8f534ec005..2d78977d8c 100644 --- a/scripts/policy/misc/trim-trace-file.zeek +++ b/scripts/policy/misc/trim-trace-file.zeek @@ -30,7 +30,7 @@ event TrimTraceFile::go(first_trim: bool) schedule trim_interval { TrimTraceFile::go(F) }; } -event bro_init() +event zeek_init() { if ( trim_interval > 0 secs ) schedule trim_interval { TrimTraceFile::go(T) }; diff --git a/scripts/policy/misc/weird-stats.zeek b/scripts/policy/misc/weird-stats.zeek index ac0914d531..bc75e2057a 100644 --- a/scripts/policy/misc/weird-stats.zeek +++ b/scripts/policy/misc/weird-stats.zeek @@ -51,7 +51,7 @@ function weird_epoch_finished(ts: time) this_epoch_weirds = table(); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(WeirdStats::LOG, [$columns = Info, $ev = log_weird_stats, diff --git a/scripts/policy/protocols/conn/known-hosts.zeek b/scripts/policy/protocols/conn/known-hosts.zeek index ef78630c6a..493784a859 100644 --- a/scripts/policy/protocols/conn/known-hosts.zeek +++ b/scripts/policy/protocols/conn/known-hosts.zeek @@ -61,7 +61,7 @@ export { global log_known_hosts: event(rec: HostsInfo); } -event bro_init() +event zeek_init() { if ( ! Known::use_host_store ) return; @@ -145,7 +145,7 @@ event Known::host_found(info: HostsInfo) event known_host_add(info); } -event bro_init() +event zeek_init() { Log::create_stream(Known::HOSTS_LOG, [$columns=HostsInfo, $ev=log_known_hosts, $path="known_hosts"]); } diff --git a/scripts/policy/protocols/conn/known-services.zeek b/scripts/policy/protocols/conn/known-services.zeek index f9e129839d..63d9f7fa71 100644 --- a/scripts/policy/protocols/conn/known-services.zeek +++ b/scripts/policy/protocols/conn/known-services.zeek @@ -80,7 +80,7 @@ redef record connection += { }; -event bro_init() +event zeek_init() { if ( ! Known::use_service_store ) return; @@ -216,7 +216,7 @@ event connection_state_remove(c: connection) &priority=-5 known_services_done(c); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Known::SERVICES_LOG, [$columns=ServicesInfo, $ev=log_known_services, diff --git a/scripts/policy/protocols/ftp/detect-bruteforcing.zeek b/scripts/policy/protocols/ftp/detect-bruteforcing.zeek index eb70688d47..4ac7b61efc 100644 --- a/scripts/policy/protocols/ftp/detect-bruteforcing.zeek +++ b/scripts/policy/protocols/ftp/detect-bruteforcing.zeek @@ -25,7 +25,7 @@ export { } -event bro_init() +event zeek_init() { local r1: SumStats::Reducer = [$stream="ftp.failed_auth", $apply=set(SumStats::UNIQUE), $unique_max=double_to_count(bruteforce_threshold+2)]; SumStats::create([$name="ftp-detect-bruteforcing", diff --git a/scripts/policy/protocols/http/detect-sqli.zeek b/scripts/policy/protocols/http/detect-sqli.zeek index 01c98ba0d7..3ad9efbfe2 100644 --- a/scripts/policy/protocols/http/detect-sqli.zeek +++ b/scripts/policy/protocols/http/detect-sqli.zeek @@ -67,7 +67,7 @@ function format_sqli_samples(samples: vector of SumStats::Observation): string return ret; } -event bro_init() &priority=3 +event zeek_init() &priority=3 { # Add filters to the metrics so that the metrics framework knows how to # determine when it looks like an actual attack and how to respond when diff --git a/scripts/policy/protocols/modbus/known-masters-slaves.zeek b/scripts/policy/protocols/modbus/known-masters-slaves.zeek index a49e1f81e4..4ce56570d8 100644 --- a/scripts/policy/protocols/modbus/known-masters-slaves.zeek +++ b/scripts/policy/protocols/modbus/known-masters-slaves.zeek @@ -33,7 +33,7 @@ export { global log_known_modbus: event(rec: ModbusInfo); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Known::MODBUS_LOG, [$columns=ModbusInfo, $ev=log_known_modbus, $path="known_modbus"]); } diff --git a/scripts/policy/protocols/modbus/track-memmap.zeek b/scripts/policy/protocols/modbus/track-memmap.zeek index 9a6e49e214..da2be29745 100644 --- a/scripts/policy/protocols/modbus/track-memmap.zeek +++ b/scripts/policy/protocols/modbus/track-memmap.zeek @@ -52,7 +52,7 @@ redef record Modbus::Info += { track_address: count &default=0; }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Modbus::REGISTER_CHANGE_LOG, [$columns=MemmapInfo, $path="modbus_register_change"]); } diff --git a/scripts/policy/protocols/smb/log-cmds.zeek b/scripts/policy/protocols/smb/log-cmds.zeek index 53e309c5ea..88108276dc 100644 --- a/scripts/policy/protocols/smb/log-cmds.zeek +++ b/scripts/policy/protocols/smb/log-cmds.zeek @@ -25,7 +25,7 @@ const deferred_logging_cmds: set[string] = { "TREE_CONNECT_ANDX", }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(SMB::CMD_LOG, [$columns=SMB::CmdInfo, $path="smb_cmd"]); } diff --git a/scripts/policy/protocols/ssh/detect-bruteforcing.zeek b/scripts/policy/protocols/ssh/detect-bruteforcing.zeek index 55687e2afd..208f3db04c 100644 --- a/scripts/policy/protocols/ssh/detect-bruteforcing.zeek +++ b/scripts/policy/protocols/ssh/detect-bruteforcing.zeek @@ -39,7 +39,7 @@ export { const ignore_guessers: table[subnet] of subnet &redef; } -event bro_init() +event zeek_init() { local r1: SumStats::Reducer = [$stream="ssh.login.failure", $apply=set(SumStats::SUM, SumStats::SAMPLE), $num_samples=5]; SumStats::create([$name="detect-ssh-bruteforcing", diff --git a/scripts/policy/protocols/ssl/heartbleed.zeek b/scripts/policy/protocols/ssl/heartbleed.zeek index ae4395289d..483c1f4ce1 100644 --- a/scripts/policy/protocols/ssl/heartbleed.zeek +++ b/scripts/policy/protocols/ssl/heartbleed.zeek @@ -45,7 +45,7 @@ type min_length: record { global min_lengths: vector of min_length = vector(); global min_lengths_tls11: vector of min_length = vector(); -event bro_init() +event zeek_init() { # Minimum length a heartbeat packet must have for different cipher suites. # Note - tls 1.1f and 1.0 have different lengths :( diff --git a/scripts/policy/protocols/ssl/known-certs.zeek b/scripts/policy/protocols/ssl/known-certs.zeek index 63a371b3e1..3841b77d87 100644 --- a/scripts/policy/protocols/ssl/known-certs.zeek +++ b/scripts/policy/protocols/ssl/known-certs.zeek @@ -72,7 +72,7 @@ export { global log_known_certs: event(rec: CertsInfo); } -event bro_init() +event zeek_init() { if ( ! Known::use_cert_store ) return; @@ -193,7 +193,7 @@ event ssl_established(c: connection) &priority=3 event Known::cert_found(info, hash); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Known::CERTS_LOG, [$columns=CertsInfo, $ev=log_known_certs, $path="known_certs"]); } diff --git a/scripts/policy/protocols/ssl/log-hostcerts-only.zeek b/scripts/policy/protocols/ssl/log-hostcerts-only.zeek index 258820664f..3aefac088a 100644 --- a/scripts/policy/protocols/ssl/log-hostcerts-only.zeek +++ b/scripts/policy/protocols/ssl/log-hostcerts-only.zeek @@ -31,7 +31,7 @@ function host_certs_only(rec: X509::Info): bool return rec$logcert; } -event bro_init() &priority=2 +event zeek_init() &priority=2 { local f = Log::get_filter(X509::LOG, "default"); Log::remove_filter(X509::LOG, "default"); # disable default logging diff --git a/scripts/policy/protocols/ssl/validate-certs.zeek b/scripts/policy/protocols/ssl/validate-certs.zeek index bd76daeceb..6a85627b3c 100644 --- a/scripts/policy/protocols/ssl/validate-certs.zeek +++ b/scripts/policy/protocols/ssl/validate-certs.zeek @@ -62,7 +62,7 @@ export { global intermediate_cache: table[string] of vector of opaque of x509; @if ( Cluster::is_enabled() ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, SSL::intermediate_add); Broker::auto_publish(Cluster::manager_topic, SSL::new_intermediate); diff --git a/scripts/policy/protocols/ssl/validate-sct.zeek b/scripts/policy/protocols/ssl/validate-sct.zeek index 4d79bfd7ad..b4db3666eb 100644 --- a/scripts/policy/protocols/ssl/validate-sct.zeek +++ b/scripts/policy/protocols/ssl/validate-sct.zeek @@ -69,7 +69,7 @@ export { global recently_validated_scts: table[string] of bool = table() &read_expire=5mins &redef; -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); } diff --git a/scripts/policy/tuning/defaults/warnings.zeek b/scripts/policy/tuning/defaults/warnings.zeek index cedc3d62ad..6c31e82d4e 100644 --- a/scripts/policy/tuning/defaults/warnings.zeek +++ b/scripts/policy/tuning/defaults/warnings.zeek @@ -4,7 +4,7 @@ @load base/utils/site -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { if ( |Site::local_nets| == 0 ) print "WARNING: No Site::local_nets have been defined. It's usually a good idea to define your local networks."; diff --git a/src/Net.cc b/src/Net.cc index d6cb6632b2..b61d365a2a 100644 --- a/src/Net.cc +++ b/src/Net.cc @@ -188,7 +188,7 @@ void net_init(name_list& interfaces, name_list& readfiles, else // have_pending_timers = 1, possibly. We don't set // that here, though, because at this point we don't know - // whether the user's bro_init() event will indeed set + // whether the user's zeek_init() event will indeed set // a timer. reading_traces = reading_live = 0; diff --git a/src/Val.cc b/src/Val.cc index b55a9090d3..340cef6bb5 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -2319,7 +2319,7 @@ void TableVal::DoExpire(double t) if ( v->ExpireAccessTime() == 0 ) { // This happens when we insert val while network_time - // hasn't been initialized yet (e.g. in bro_init()), and + // hasn't been initialized yet (e.g. in zeek_init()), and // also when bro_start_network_time hasn't been initialized // (e.g. before first packet). The expire_access_time is // correct, so we just need to wait. diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc index 1546f846e5..c7e156b41e 100644 --- a/src/analyzer/Manager.cc +++ b/src/analyzer/Manager.cc @@ -113,7 +113,7 @@ void Manager::InitPostScript() void Manager::DumpDebug() { #ifdef DEBUG - DBG_LOG(DBG_ANALYZER, "Available analyzers after bro_init():"); + DBG_LOG(DBG_ANALYZER, "Available analyzers after zeek_init():"); list all_analyzers = GetComponents(); for ( list::const_iterator i = all_analyzers.begin(); i != all_analyzers.end(); ++i ) DBG_LOG(DBG_ANALYZER, " %s (%s)", (*i)->Name().c_str(), diff --git a/src/analyzer/Manager.h b/src/analyzer/Manager.h index 7f58a45cbf..8f6d982394 100644 --- a/src/analyzer/Manager.h +++ b/src/analyzer/Manager.h @@ -78,10 +78,10 @@ public: /** * Dumps out the state of all registered analyzers to the \c analyzer - * debug stream. Should be called only after any \c bro_init events + * debug stream. Should be called only after any \c zeek_init events * have executed to ensure that any of their changes are applied. */ - void DumpDebug(); // Called after bro_init() events. + void DumpDebug(); // Called after zeek_init() events. /** * Enables an analyzer type. Only enabled analyzers will be diff --git a/src/analyzer/protocol/tcp/events.bif b/src/analyzer/protocol/tcp/events.bif index d93ebe4819..3e053458ea 100644 --- a/src/analyzer/protocol/tcp/events.bif +++ b/src/analyzer/protocol/tcp/events.bif @@ -151,7 +151,7 @@ event connection_reset%(c: connection%); ## connection_first_ACK connection_half_finished connection_partial_close ## connection_rejected connection_reset connection_reused connection_state_remove ## connection_status_update connection_timeout scheduled_analyzer_applied -## new_connection new_connection_contents partial_connection bro_done +## new_connection new_connection_contents partial_connection zeek_done event connection_pending%(c: connection%); ## Generated for a SYN packet. Bro raises this event for every SYN packet seen diff --git a/src/bro.bif b/src/bro.bif index 96419ab83d..4440f823c7 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -2994,8 +2994,8 @@ function uuid_to_string%(uuid: string%): string ## ## .. note:: ## -## This function must be called at Bro startup time, e.g., in the event -## :bro:id:`bro_init`. +## This function must be called at Zeek startup time, e.g., in the event +## :bro:id:`zeek_init`. function merge_pattern%(p1: pattern, p2: pattern%): pattern &deprecated %{ RE_Matcher* re = new RE_Matcher(); @@ -3061,8 +3061,8 @@ function convert_for_pattern%(s: string%): string ## ## .. note:: ## -## This function must be called at Bro startup time, e.g., in the event -## :bro:id:`bro_init`. +## This function must be called at Zeek startup time, e.g., in the event +## :bro:id:`zeek_init`. function string_to_pattern%(s: string, convert: bool%): pattern %{ const char* ss = (const char*) (s->Bytes()); @@ -4953,7 +4953,7 @@ function enable_communication%(%): any &deprecated %{ if ( bro_start_network_time != 0.0 ) { - builtin_error("communication must be enabled in bro_init"); + builtin_error("communication must be enabled in zeek_init"); return 0; } diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index d31198ced7..ec69308790 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -138,7 +138,7 @@ Manager::Manager(bool arg_reading_pcaps) { bound_port = 0; reading_pcaps = arg_reading_pcaps; - after_bro_init = false; + after_zeek_init = false; peer_count = 0; log_topic_func = nullptr; vector_of_data_type = nullptr; @@ -772,7 +772,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame) bool Manager::Subscribe(const string& topic_prefix) { DBG_LOG(DBG_BROKER, "Subscribing to topic prefix %s", topic_prefix.c_str()); - bstate->subscriber.add_topic(topic_prefix, ! after_bro_init); + bstate->subscriber.add_topic(topic_prefix, ! after_zeek_init); return true; } @@ -799,7 +799,7 @@ bool Manager::Unsubscribe(const string& topic_prefix) } DBG_LOG(DBG_BROKER, "Unsubscribing from topic prefix %s", topic_prefix.c_str()); - bstate->subscriber.remove_topic(topic_prefix, ! after_bro_init); + bstate->subscriber.remove_topic(topic_prefix, ! after_zeek_init); return true; } diff --git a/src/broker/Manager.h b/src/broker/Manager.h index 87aba80058..a0520698da 100644 --- a/src/broker/Manager.h +++ b/src/broker/Manager.h @@ -66,8 +66,8 @@ public: */ void InitPostScript(); - void BroInitDone() - { after_bro_init = true; } + void ZeekInitDone() + { after_zeek_init = true; } /** * Shuts Broker down at termination. @@ -380,7 +380,7 @@ private: uint16_t bound_port; bool reading_pcaps; - bool after_bro_init; + bool after_zeek_init; int peer_count; Func* log_topic_func; diff --git a/src/event.bif b/src/event.bif index ae00c9b653..4585003090 100644 --- a/src/event.bif +++ b/src/event.bif @@ -30,36 +30,46 @@ # # - .. todo:: -## Generated at Bro initialization time. The event engine generates this +## Generated at Zeek initialization time. The event engine generates this ## event just before normal input processing begins. It can be used to execute -## one-time initialization code at startup. At the time a handler runs, Bro will +## one-time initialization code at startup. At the time a handler runs, Zeek will ## have executed any global initializations and statements. ## -## .. bro:see:: bro_done +## .. bro:see:: zeek_done ## ## .. note:: ## -## When a ``bro_init`` handler executes, Bro has not yet seen any input +## When a ``zeek_init`` handler executes, Zeek has not yet seen any input ## packets and therefore :bro:id:`network_time` is not initialized yet. An -## artifact of that is that any timer installed in a ``bro_init`` handler +## artifact of that is that any timer installed in a ``zeek_init`` handler ## will fire immediately with the first packet. The standard way to work ## around that is to ignore the first time the timer fires and immediately ## reschedule. ## -event bro_init%(%); +event zeek_init%(%); -## Generated at Bro termination time. The event engine generates this event when -## Bro is about to terminate, either due to having exhausted reading its input -## trace file(s), receiving a termination signal, or because Bro was run without +## Deprecated synonym for ``zeek_init``. +## +## .. bro:see: zeek_init +event bro_init%(%) &deprecated; + +## Generated at Zeek termination time. The event engine generates this event when +## Zeek is about to terminate, either due to having exhausted reading its input +## trace file(s), receiving a termination signal, or because Zeek was run without ## a network input source and has finished executing any global statements. ## -## .. bro:see:: bro_init +## .. bro:see:: zeek_init ## ## .. note:: ## -## If Bro terminates due to an invocation of :bro:id:`exit`, then this event +## If Zeek terminates due to an invocation of :bro:id:`exit`, then this event ## is not generated. -event bro_done%(%); +event zeek_done%(%); + +## Deprecated synonym for ``zeek_done``. +## +## .. bro:see: zeek_done +event bro_done%(%) &deprecated; ## Generated for every new connection. This event is raised with the first ## packet of a previously unknown connection. Bro uses a flow-based definition diff --git a/src/main.cc b/src/main.cc index e0d8da66e4..1d2b89cc0c 100644 --- a/src/main.cc +++ b/src/main.cc @@ -339,9 +339,9 @@ void terminate_bro() brofiler.WriteStats(); - EventHandlerPtr bro_done = internal_handler("bro_done"); - if ( bro_done ) - mgr.QueueEvent(bro_done, new val_list); + EventHandlerPtr zeek_done = internal_handler("zeek_done"); + if ( zeek_done ) + mgr.QueueEvent(zeek_done, new val_list); timer_mgr->Expire(); mgr.Drain(); @@ -1136,9 +1136,9 @@ int main(int argc, char** argv) // we don't have any other source for it. net_update_time(current_time()); - EventHandlerPtr bro_init = internal_handler("bro_init"); - if ( bro_init ) //### this should be a function - mgr.QueueEvent(bro_init, new val_list); + EventHandlerPtr zeek_init = internal_handler("zeek_init"); + if ( zeek_init ) //### this should be a function + mgr.QueueEvent(zeek_init, new val_list); EventRegistry::string_list* dead_handlers = event_registry->UnusedHandlers(); @@ -1204,7 +1204,7 @@ int main(int argc, char** argv) if ( reporter->Errors() > 0 && ! getenv("ZEEK_ALLOW_INIT_ERRORS") ) reporter->FatalError("errors occurred while initializing"); - broker_mgr->BroInitDone(); + broker_mgr->ZeekInitDone(); analyzer_mgr->DumpDebug(); have_pending_timers = ! reading_traces && timer_mgr->Size() > 0; diff --git a/src/parse.y b/src/parse.y index c0980ce8de..338436da9e 100644 --- a/src/parse.y +++ b/src/parse.y @@ -1171,6 +1171,12 @@ func_hdr: } | TOK_EVENT event_id func_params opt_attr { + // Gracefully handle the deprecation of bro_init and bro_done + if ( streq("bro_init", $2->Name()) ) + $2 = global_scope()->Lookup("zeek_init"); + else if ( streq("bro_done", $2->Name()) ) + $2 = global_scope()->Lookup("zeek_done"); + begin_func($2, current_module.c_str(), FUNC_FLAVOR_EVENT, 0, $3, $4); $$ = $3; diff --git a/testing/btest/Baseline/bifs.global_sizes/out b/testing/btest/Baseline/bifs.global_sizes/out index 76c40b297a..fe0e737de0 100644 --- a/testing/btest/Baseline/bifs.global_sizes/out +++ b/testing/btest/Baseline/bifs.global_sizes/out @@ -1 +1 @@ -found bro_init +found zeek_init diff --git a/testing/btest/Baseline/core.plugins.hooks/output b/testing/btest/Baseline/core.plugins.hooks/output index 87f20f8512..f030cb0af2 100644 --- a/testing/btest/Baseline/core.plugins.hooks/output +++ b/testing/btest/Baseline/core.plugins.hooks/output @@ -188,7 +188,7 @@ 0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugin, (SumStats::UNIQUE, anonymous-function{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || flattenSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = flattenSumStats::rv$unique_vals})) -> 0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugin, (SumStats::VARIANCE, anonymous-function{ if (1 < SumStats::rv$num) SumStats::rv$var_s += ((SumStats::val - SumStats::rv$prev_avg) * (SumStats::val - SumStats::rv$average))SumStats::calc_variance(SumStats::rv)SumStats::rv$prev_avg = SumStats::rv$average})) -> 0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugins, ()) -> -0.000000 MetaHookPost CallFunction(bro_init, ()) -> +0.000000 MetaHookPost CallFunction(zeek_init, ()) -> 0.000000 MetaHookPost CallFunction(filter_change_tracking, ()) -> 0.000000 MetaHookPost CallFunction(set_to_regex, ({}, (^\.?|\.)(~~)$)) -> 0.000000 MetaHookPost CallFunction(set_to_regex, ({}, (^\.?|\.)(~~)$)) -> @@ -576,7 +576,7 @@ 0.000000 MetaHookPost LoadFile(base/utils/thresholds) -> -1 0.000000 MetaHookPost LoadFile(base/utils/time) -> -1 0.000000 MetaHookPost LoadFile(base/utils/urls) -> -1 -0.000000 MetaHookPost QueueEvent(bro_init()) -> false +0.000000 MetaHookPost QueueEvent(zeek_init()) -> false 0.000000 MetaHookPost QueueEvent(filter_change_tracking()) -> false 0.000000 MetaHookPre CallFunction(Analyzer::disable_analyzer, (Analyzer::ANALYZER_BACKDOOR)) 0.000000 MetaHookPre CallFunction(Analyzer::disable_analyzer, (Analyzer::ANALYZER_INTERCONN)) @@ -768,7 +768,7 @@ 0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugin, (SumStats::UNIQUE, anonymous-function{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || flattenSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = flattenSumStats::rv$unique_vals})) 0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugin, (SumStats::VARIANCE, anonymous-function{ if (1 < SumStats::rv$num) SumStats::rv$var_s += ((SumStats::val - SumStats::rv$prev_avg) * (SumStats::val - SumStats::rv$average))SumStats::calc_variance(SumStats::rv)SumStats::rv$prev_avg = SumStats::rv$average})) 0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugins, ()) -0.000000 MetaHookPre CallFunction(bro_init, ()) +0.000000 MetaHookPre CallFunction(zeek_init, ()) 0.000000 MetaHookPre CallFunction(filter_change_tracking, ()) 0.000000 MetaHookPre CallFunction(set_to_regex, ({}, (^\.?|\.)(~~)$)) 0.000000 MetaHookPre CallFunction(set_to_regex, ({}, (^\.?|\.)(~~)$)) @@ -1156,7 +1156,7 @@ 0.000000 MetaHookPre LoadFile(base/utils/thresholds) 0.000000 MetaHookPre LoadFile(base/utils/time) 0.000000 MetaHookPre LoadFile(base/utils/urls) -0.000000 MetaHookPre QueueEvent(bro_init()) +0.000000 MetaHookPre QueueEvent(zeek_init()) 0.000000 MetaHookPre QueueEvent(filter_change_tracking()) 0.000000 | HookCallFunction Analyzer::disable_analyzer(Analyzer::ANALYZER_BACKDOOR) 0.000000 | HookCallFunction Analyzer::disable_analyzer(Analyzer::ANALYZER_INTERCONN) @@ -1348,7 +1348,7 @@ 0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::UNIQUE, anonymous-function{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || flattenSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = flattenSumStats::rv$unique_vals}) 0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::VARIANCE, anonymous-function{ if (1 < SumStats::rv$num) SumStats::rv$var_s += ((SumStats::val - SumStats::rv$prev_avg) * (SumStats::val - SumStats::rv$average))SumStats::calc_variance(SumStats::rv)SumStats::rv$prev_avg = SumStats::rv$average}) 0.000000 | HookCallFunction SumStats::register_observe_plugins() -0.000000 | HookCallFunction bro_init() +0.000000 | HookCallFunction zeek_init() 0.000000 | HookCallFunction filter_change_tracking() 0.000000 | HookCallFunction set_to_regex({}, (^\.?|\.)(~~)$) 0.000000 | HookCallFunction set_to_regex({}, (^\.?|\.)(~~)$) @@ -1736,7 +1736,7 @@ 0.000000 | HookLoadFile base/utils/thresholds.bro/bro 0.000000 | HookLoadFile base/utils/time.bro/bro 0.000000 | HookLoadFile base/utils/urls.bro/bro -0.000000 | HookQueueEvent bro_init() +0.000000 | HookQueueEvent zeek_init() 0.000000 | HookQueueEvent filter_change_tracking() 1362692526.869344 MetaHookPost CallFunction(ChecksumOffloading::check, ()) -> 1362692526.869344 MetaHookPost CallFunction(filter_change_tracking, ()) -> @@ -2193,7 +2193,7 @@ 1362692527.080972 MetaHookPost CallFunction(HTTP::get_file_handle, ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> 1362692527.080972 MetaHookPost CallFunction(Log::default_path_func, (Conn::LOG, , [ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={}])) -> 1362692527.080972 MetaHookPost CallFunction(Log::write, (Conn::LOG, [ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={}])) -> -1362692527.080972 MetaHookPost CallFunction(bro_done, ()) -> +1362692527.080972 MetaHookPost CallFunction(zeek_done, ()) -> 1362692527.080972 MetaHookPost CallFunction(connection_state_remove, ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> 1362692527.080972 MetaHookPost CallFunction(filter_change_tracking, ()) -> 1362692527.080972 MetaHookPost CallFunction(get_file_handle, (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> @@ -2214,7 +2214,7 @@ 1362692527.080972 MetaHookPost DrainEvents() -> 1362692527.080972 MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false 1362692527.080972 MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false -1362692527.080972 MetaHookPost QueueEvent(bro_done()) -> false +1362692527.080972 MetaHookPost QueueEvent(zeek_done()) -> false 1362692527.080972 MetaHookPost QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false 1362692527.080972 MetaHookPost QueueEvent(filter_change_tracking()) -> false 1362692527.080972 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false @@ -2227,7 +2227,7 @@ 1362692527.080972 MetaHookPre CallFunction(HTTP::get_file_handle, ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) 1362692527.080972 MetaHookPre CallFunction(Log::default_path_func, (Conn::LOG, , [ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={}])) 1362692527.080972 MetaHookPre CallFunction(Log::write, (Conn::LOG, [ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={}])) -1362692527.080972 MetaHookPre CallFunction(bro_done, ()) +1362692527.080972 MetaHookPre CallFunction(zeek_done, ()) 1362692527.080972 MetaHookPre CallFunction(connection_state_remove, ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre CallFunction(filter_change_tracking, ()) 1362692527.080972 MetaHookPre CallFunction(get_file_handle, (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) @@ -2248,7 +2248,7 @@ 1362692527.080972 MetaHookPre DrainEvents() 1362692527.080972 MetaHookPre QueueEvent(ChecksumOffloading::check()) 1362692527.080972 MetaHookPre QueueEvent(ChecksumOffloading::check()) -1362692527.080972 MetaHookPre QueueEvent(bro_done()) +1362692527.080972 MetaHookPre QueueEvent(zeek_done()) 1362692527.080972 MetaHookPre QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre QueueEvent(filter_change_tracking()) 1362692527.080972 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) @@ -2262,7 +2262,7 @@ 1362692527.080972 | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) 1362692527.080972 | HookCallFunction Log::default_path_func(Conn::LOG, , [ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={}]) 1362692527.080972 | HookCallFunction Log::write(Conn::LOG, [ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={}]) -1362692527.080972 | HookCallFunction bro_done() +1362692527.080972 | HookCallFunction zeek_done() 1362692527.080972 | HookCallFunction connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookCallFunction filter_change_tracking() 1362692527.080972 | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) @@ -2283,7 +2283,7 @@ 1362692527.080972 | HookDrainEvents 1362692527.080972 | HookQueueEvent ChecksumOffloading::check() 1362692527.080972 | HookQueueEvent ChecksumOffloading::check() -1362692527.080972 | HookQueueEvent bro_done() +1362692527.080972 | HookQueueEvent zeek_done() 1362692527.080972 | HookQueueEvent connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookQueueEvent filter_change_tracking() 1362692527.080972 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0], start_time=1362692526.869344, duration=0.211484, service={HTTP}, addl=, hot=0, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1], irc=, modbus=, radius=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) diff --git a/testing/btest/Baseline/core.when-interpreter-exceptions/bro.output b/testing/btest/Baseline/core.when-interpreter-exceptions/bro.output index 04236c9f83..3abe7bcfd0 100644 --- a/testing/btest/Baseline/core.when-interpreter-exceptions/bro.output +++ b/testing/btest/Baseline/core.when-interpreter-exceptions/bro.output @@ -6,7 +6,7 @@ received termination signal [f(F)] f() done, no exception, T [f(T)] -[bro_init()] +[zeek_init()] timeout g(), T timeout timeout g(), F diff --git a/testing/btest/Baseline/doc.manual.connection_record_01/.stdout b/testing/btest/Baseline/doc.manual.connection_record_01/.stdout deleted file mode 100644 index 7f134460e3..0000000000 --- a/testing/btest/Baseline/doc.manual.connection_record_01/.stdout +++ /dev/null @@ -1,5 +0,0 @@ -[id=[orig_h=212.180.42.100, orig_p=25000/tcp, resp_h=131.243.64.3, resp_p=53/tcp], orig=[size=29, state=5, num_pkts=6, num_bytes_ip=273, flow_label=0], resp=[size=44, state=5, num_pkts=5, num_bytes_ip=248, flow_label=0], start_time=930613226.067666, duration=0.709643, service={ - -}, addl=, hot=0, history=ShADadFf, uid=UWkUyAuUGXf, tunnel=, conn=[ts=930613226.067666, uid=UWkUyAuUGXf, id=[orig_h=212.180.42.100, orig_p=25000/tcp, resp_h=131.243.64.3, resp_p=53/tcp], proto=tcp, service=, duration=0.709643, orig_bytes=29, resp_bytes=44, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=6, orig_ip_bytes=273, resp_pkts=5, resp_ip_bytes=248, tunnel_parents={ - -}], extract_orig=F, extract_resp=F] diff --git a/testing/btest/Baseline/doc.manual.connection_record_02/.stdout b/testing/btest/Baseline/doc.manual.connection_record_02/.stdout deleted file mode 100644 index 824dd03097..0000000000 --- a/testing/btest/Baseline/doc.manual.connection_record_02/.stdout +++ /dev/null @@ -1,9 +0,0 @@ -[id=[orig_h=212.180.42.100, orig_p=25000/tcp, resp_h=131.243.64.3, resp_p=53/tcp], orig=[size=29, state=5, num_pkts=6, num_bytes_ip=273, flow_label=0], resp=[size=44, state=5, num_pkts=5, num_bytes_ip=248, flow_label=0], start_time=930613226.067666, duration=0.709643, service={ - -}, addl=, hot=0, history=ShADadFf, uid=UWkUyAuUGXf, tunnel=, conn=[ts=930613226.067666, uid=UWkUyAuUGXf, id=[orig_h=212.180.42.100, orig_p=25000/tcp, resp_h=131.243.64.3, resp_p=53/tcp], proto=tcp, service=, duration=0.709643, orig_bytes=29, resp_bytes=44, conn_state=SF, local_orig=, missed_bytes=0, history=ShADadFf, orig_pkts=6, orig_ip_bytes=273, resp_pkts=5, resp_ip_bytes=248, tunnel_parents={ - -}], extract_orig=F, extract_resp=F, dns=, dns_state=[pending={ - -}, finished_answers={ -34798 -}]] diff --git a/testing/btest/Baseline/doc.manual.data_struct_record_01/.stdout b/testing/btest/Baseline/doc.manual.data_struct_record_01/.stdout deleted file mode 100644 index 4e628b9ae7..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_record_01/.stdout +++ /dev/null @@ -1,6 +0,0 @@ -Service: dns(RFC1035) - port: 53/tcp - port: 53/udp -Service: http(RFC2616) - port: 80/tcp - port: 8080/tcp diff --git a/testing/btest/Baseline/doc.manual.data_struct_record_02/.stdout b/testing/btest/Baseline/doc.manual.data_struct_record_02/.stdout deleted file mode 100644 index 0428764bea..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_record_02/.stdout +++ /dev/null @@ -1,7 +0,0 @@ -System: morlock - Service: dns(RFC1035) - port: 53/tcp - port: 53/udp - Service: http(RFC2616) - port: 80/tcp - port: 8080/tcp diff --git a/testing/btest/Baseline/doc.manual.data_struct_set_declaration/.stdout b/testing/btest/Baseline/doc.manual.data_struct_set_declaration/.stdout deleted file mode 100644 index d1aa16c7d3..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_set_declaration/.stdout +++ /dev/null @@ -1,8 +0,0 @@ -SSL Port: 993/tcp -SSL Port: 22/tcp -SSL Port: 587/tcp -SSL Port: 443/tcp -Non-SSL Port: 143/tcp -Non-SSL Port: 25/tcp -Non-SSL Port: 80/tcp -Non-SSL Port: 23/tcp diff --git a/testing/btest/Baseline/doc.manual.data_struct_table_complex/.stdout b/testing/btest/Baseline/doc.manual.data_struct_table_complex/.stdout deleted file mode 100644 index e22f36a244..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_table_complex/.stdout +++ /dev/null @@ -1,4 +0,0 @@ -Kiru was released in 1968 by Toho studios, directed by Kihachi Okamoto and starring Tatsuya Nakadai -Goyokin was released in 1969 by Fuji studios, directed by Hideo Gosha and starring Tatsuya Nakadai -Harakiri was released in 1962 by Shochiku Eiga studios, directed by Masaki Kobayashi and starring Tatsuya Nakadai -Tasogare Seibei was released in 2002 by Eisei Gekijo studios, directed by Yoji Yamada and starring Hiroyuki Sanada diff --git a/testing/btest/Baseline/doc.manual.data_struct_table_declaration/.stdout b/testing/btest/Baseline/doc.manual.data_struct_table_declaration/.stdout deleted file mode 100644 index 19b1648904..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_table_declaration/.stdout +++ /dev/null @@ -1,4 +0,0 @@ -Service Name: IMAPS - Common Port: 993/tcp -Service Name: HTTPS - Common Port: 443/tcp -Service Name: SSH - Common Port: 22/tcp -Service Name: SMTPS - Common Port: 587/tcp diff --git a/testing/btest/Baseline/doc.manual.data_struct_vector/.stdout b/testing/btest/Baseline/doc.manual.data_struct_vector/.stdout deleted file mode 100644 index 8348ce7198..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_vector/.stdout +++ /dev/null @@ -1,2 +0,0 @@ -[1, 2, 3, 4] -[1, 2, 3, 4] diff --git a/testing/btest/Baseline/doc.manual.data_struct_vector_declaration/.stdout b/testing/btest/Baseline/doc.manual.data_struct_vector_declaration/.stdout deleted file mode 100644 index 48ce5d9c56..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_vector_declaration/.stdout +++ /dev/null @@ -1,4 +0,0 @@ -contents of v1: [1, 2, 3, 4] -length of v1: 4 -contents of v1: [1, 2, 3, 4] -length of v2: 4 diff --git a/testing/btest/Baseline/doc.manual.data_struct_vector_iter/.stdout b/testing/btest/Baseline/doc.manual.data_struct_vector_iter/.stdout deleted file mode 100644 index 0326e6580e..0000000000 --- a/testing/btest/Baseline/doc.manual.data_struct_vector_iter/.stdout +++ /dev/null @@ -1,3 +0,0 @@ -1.2.0.0/18 -2.3.0.0/18 -3.4.0.0/18 diff --git a/testing/btest/Baseline/doc.manual.data_type_const/.stdout b/testing/btest/Baseline/doc.manual.data_type_const/.stdout deleted file mode 100644 index 0e49670a83..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_const/.stdout +++ /dev/null @@ -1,4 +0,0 @@ -{ -[6666/tcp] = IRC, -[80/tcp] = WWW -} diff --git a/testing/btest/Baseline/doc.manual.data_type_const_simple/.stdout b/testing/btest/Baseline/doc.manual.data_type_const_simple/.stdout deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/testing/btest/Baseline/doc.manual.data_type_declaration/.stdout b/testing/btest/Baseline/doc.manual.data_type_declaration/.stdout deleted file mode 100644 index a6f28b5e52..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_declaration/.stdout +++ /dev/null @@ -1 +0,0 @@ -A: 10, B: 10 diff --git a/testing/btest/Baseline/doc.manual.data_type_interval/.stdout b/testing/btest/Baseline/doc.manual.data_type_interval/.stdout deleted file mode 100644 index 1cd5999711..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_interval/.stdout +++ /dev/null @@ -1,15 +0,0 @@ -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.118 -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3 - Time since last connection: 132.0 msecs 97.0 usecs -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3 - Time since last connection: 177.0 usecs -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3 - Time since last connection: 2.0 msecs 177.0 usecs -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3 - Time since last connection: 33.0 msecs 898.0 usecs -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3 - Time since last connection: 35.0 usecs -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3 - Time since last connection: 2.0 msecs 532.0 usecs -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.2 - Time since last connection: 7.0 msecs 866.0 usecs diff --git a/testing/btest/Baseline/doc.manual.data_type_local/.stdout b/testing/btest/Baseline/doc.manual.data_type_local/.stdout deleted file mode 100644 index e150c0b19d..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_local/.stdout +++ /dev/null @@ -1 +0,0 @@ -i + 2 = 12 diff --git a/testing/btest/Baseline/doc.manual.data_type_pattern_01/.stdout b/testing/btest/Baseline/doc.manual.data_type_pattern_01/.stdout deleted file mode 100644 index 11358a776e..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_pattern_01/.stdout +++ /dev/null @@ -1,3 +0,0 @@ -The - brown fox jumped over the - dog. diff --git a/testing/btest/Baseline/doc.manual.data_type_pattern_02/.stdout b/testing/btest/Baseline/doc.manual.data_type_pattern_02/.stdout deleted file mode 100644 index 808dc3d572..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_pattern_02/.stdout +++ /dev/null @@ -1,2 +0,0 @@ -equality and /^?(equal)$?/ are not equal -equality and /^?(equality)$?/ are equal diff --git a/testing/btest/Baseline/doc.manual.data_type_subnets/.stdout b/testing/btest/Baseline/doc.manual.data_type_subnets/.stdout deleted file mode 100644 index facaaabe64..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_subnets/.stdout +++ /dev/null @@ -1,4 +0,0 @@ -172.16.4.56 belongs to subnet 172.16.0.0/20 -172.16.47.254 belongs to subnet 172.16.32.0/20 -172.16.22.45 belongs to subnet 172.16.16.0/20 -172.16.1.1 belongs to subnet 172.16.0.0/20 diff --git a/testing/btest/Baseline/doc.manual.data_type_time/.stdout b/testing/btest/Baseline/doc.manual.data_type_time/.stdout deleted file mode 100644 index 149cb40e2a..0000000000 --- a/testing/btest/Baseline/doc.manual.data_type_time/.stdout +++ /dev/null @@ -1,8 +0,0 @@ -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.118^J -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.3^J -2011/06/18 19:03:08: New connection established from 141.142.220.118 to 208.80.152.2^J diff --git a/testing/btest/Baseline/doc.manual.framework_logging_factorial_01/.stdout b/testing/btest/Baseline/doc.manual.framework_logging_factorial_01/.stdout deleted file mode 100644 index db47b283d0..0000000000 --- a/testing/btest/Baseline/doc.manual.framework_logging_factorial_01/.stdout +++ /dev/null @@ -1,10 +0,0 @@ -1 -2 -6 -24 -120 -720 -5040 -40320 -362880 -3628800 diff --git a/testing/btest/Baseline/doc.manual.framework_logging_factorial_02/factor.log b/testing/btest/Baseline/doc.manual.framework_logging_factorial_02/factor.log deleted file mode 100644 index c643116265..0000000000 --- a/testing/btest/Baseline/doc.manual.framework_logging_factorial_02/factor.log +++ /dev/null @@ -1,19 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path factor -#open 2013-03-19-03-25-33 -#fields num factorial_num -#types count count -1 1 -2 2 -3 6 -4 24 -5 120 -6 720 -7 5040 -8 40320 -9 362880 -10 3628800 -#close 2013-03-19-03-25-33 diff --git a/testing/btest/Baseline/doc.manual.framework_logging_factorial_03/factor-mod5.log b/testing/btest/Baseline/doc.manual.framework_logging_factorial_03/factor-mod5.log deleted file mode 100644 index 2a466484d6..0000000000 --- a/testing/btest/Baseline/doc.manual.framework_logging_factorial_03/factor-mod5.log +++ /dev/null @@ -1,15 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path factor-mod5 -#open 2013-03-20-03-22-52 -#fields num factorial_num -#types count count -5 120 -6 720 -7 5040 -8 40320 -9 362880 -10 3628800 -#close 2013-03-20-03-22-52 diff --git a/testing/btest/Baseline/doc.manual.framework_logging_factorial_03/factor-non5.log b/testing/btest/Baseline/doc.manual.framework_logging_factorial_03/factor-non5.log deleted file mode 100644 index 4430dcc8a4..0000000000 --- a/testing/btest/Baseline/doc.manual.framework_logging_factorial_03/factor-non5.log +++ /dev/null @@ -1,13 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path factor-non5 -#open 2013-03-20-03-22-52 -#fields num factorial_num -#types count count -1 1 -2 2 -3 6 -4 24 -#close 2013-03-20-03-22-52 diff --git a/testing/btest/Baseline/doc.manual.framework_logging_factorial_04/factor-mod5.log b/testing/btest/Baseline/doc.manual.framework_logging_factorial_04/factor-mod5.log deleted file mode 100644 index 6b50ca55e7..0000000000 --- a/testing/btest/Baseline/doc.manual.framework_logging_factorial_04/factor-mod5.log +++ /dev/null @@ -1,15 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path factor-mod5 -#open 2013-03-25-02-00-12 -#fields num factorial_num -#types count count -5 120 -6 720 -7 5040 -8 40320 -9 362880 -10 3628800 -#close 2013-03-25-02-00-12 diff --git a/testing/btest/Baseline/doc.manual.framework_logging_factorial_04/factor-non5.log b/testing/btest/Baseline/doc.manual.framework_logging_factorial_04/factor-non5.log deleted file mode 100644 index d272ba48a9..0000000000 --- a/testing/btest/Baseline/doc.manual.framework_logging_factorial_04/factor-non5.log +++ /dev/null @@ -1,13 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path factor-non5 -#open 2013-03-25-02-00-12 -#fields num factorial_num -#types count count -1 1 -2 2 -3 6 -4 24 -#close 2013-03-25-02-00-12 diff --git a/testing/btest/Baseline/doc.manual.framework_notice_hook_01/.stdout b/testing/btest/Baseline/doc.manual.framework_notice_hook_01/.stdout deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/testing/btest/Baseline/doc.manual.framework_notice_hook_suppression_01/.stdout b/testing/btest/Baseline/doc.manual.framework_notice_hook_suppression_01/.stdout deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/testing/btest/Baseline/doc.manual.framework_notice_shortcuts_01/.stdout b/testing/btest/Baseline/doc.manual.framework_notice_shortcuts_01/.stdout deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/testing/btest/Baseline/doc.manual.framework_notice_shortcuts_02/.stdout b/testing/btest/Baseline/doc.manual.framework_notice_shortcuts_02/.stdout deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/.stdout b/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/.stdout deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/conn.log b/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/conn.log deleted file mode 100644 index 6eb08725f5..0000000000 --- a/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/conn.log +++ /dev/null @@ -1,43 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path conn -#open 2013-05-05-20-51-24 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents -#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] -1300475167.096535 UWkUyAuUGXf 141.142.220.202 5353 224.0.0.251 5353 udp dns - - - S0 - 0 D 1 73 0 0 - -1300475167.097012 arKYeMETxOg fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - 0 D 1 199 0 0 - -1300475167.099816 k6kgXLOoSKl 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - 0 D 1 179 0 0 - -1300475168.853899 TEfuqmmG4bh 141.142.220.118 43927 141.142.2.2 53 udp dns 0.000435 38 89 SF - 0 Dd 1 66 1 117 - -1300475168.854378 FrJExwHcSal 141.142.220.118 37676 141.142.2.2 53 udp dns 0.000420 52 99 SF - 0 Dd 1 80 1 127 - -1300475168.854837 5OKnoww6xl4 141.142.220.118 40526 141.142.2.2 53 udp dns 0.000392 38 183 SF - 0 Dd 1 66 1 211 - -1300475168.857956 fRFu0wcOle6 141.142.220.118 32902 141.142.2.2 53 udp dns 0.000317 38 89 SF - 0 Dd 1 66 1 117 - -1300475168.858306 qSsw6ESzHV4 141.142.220.118 59816 141.142.2.2 53 udp dns 0.000343 52 99 SF - 0 Dd 1 80 1 127 - -1300475168.858713 iE6yhOq3SF 141.142.220.118 59714 141.142.2.2 53 udp dns 0.000375 38 183 SF - 0 Dd 1 66 1 211 - -1300475168.891644 qCaWGmzFtM5 141.142.220.118 58206 141.142.2.2 53 udp dns 0.000339 38 89 SF - 0 Dd 1 66 1 117 - -1300475168.892037 70MGiRM1Qf4 141.142.220.118 38911 141.142.2.2 53 udp dns 0.000335 52 99 SF - 0 Dd 1 80 1 127 - -1300475168.892414 h5DsfNtYzi1 141.142.220.118 59746 141.142.2.2 53 udp dns 0.000421 38 183 SF - 0 Dd 1 66 1 211 - -1300475168.893988 c4Zw9TmAE05 141.142.220.118 45000 141.142.2.2 53 udp dns 0.000384 38 89 SF - 0 Dd 1 66 1 117 - -1300475168.894422 EAr0uf4mhq 141.142.220.118 48479 141.142.2.2 53 udp dns 0.000317 52 99 SF - 0 Dd 1 80 1 127 - -1300475168.894787 GvmoxJFXdTa 141.142.220.118 48128 141.142.2.2 53 udp dns 0.000423 38 183 SF - 0 Dd 1 66 1 211 - -1300475168.901749 slFea8xwSmb 141.142.220.118 56056 141.142.2.2 53 udp dns 0.000402 36 131 SF - 0 Dd 1 64 1 159 - -1300475168.902195 UfGkYA2HI2g 141.142.220.118 55092 141.142.2.2 53 udp dns 0.000374 36 198 SF - 0 Dd 1 64 1 226 - -1300475169.899438 BWaU4aSuwkc 141.142.220.44 5353 224.0.0.251 5353 udp dns - - - S0 - 0 D 1 85 0 0 - -1300475170.862384 10XodEwRycf 141.142.220.226 137 141.142.220.255 137 udp dns 2.613017 350 0 S0 - 0 D 7 546 0 0 - -1300475171.675372 zno26fFZkrh fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp dns 0.100096 66 0 S0 - 0 D 2 162 0 0 - -1300475171.677081 v5rgkJBig5l 141.142.220.226 55131 224.0.0.252 5355 udp dns 0.100021 66 0 S0 - 0 D 2 122 0 0 - -1300475173.116749 eWZCH7OONC1 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp dns 0.099801 66 0 S0 - 0 D 2 162 0 0 - -1300475173.117362 0Pwk3ntf8O3 141.142.220.226 55671 224.0.0.252 5355 udp dns 0.099849 66 0 S0 - 0 D 2 122 0 0 - -1300475173.153679 0HKorjr8Zp7 141.142.220.238 56641 141.142.220.255 137 udp dns - - - S0 - 0 D 1 78 0 0 - -1300475168.859163 GSxOnSLghOa 141.142.220.118 49998 208.80.152.3 80 tcp http 0.215893 1130 734 S1 - 0 ShADad 6 1450 4 950 - -1300475168.652003 nQcgTWjvg4c 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - 0 DdA 2 567 1 402 - -1300475168.895267 0Q4FH8sESw5 141.142.220.118 50001 208.80.152.3 80 tcp http 0.227284 1178 734 S1 - 0 ShADad 6 1498 4 950 - -1300475168.902635 i2rO3KD1Syg 141.142.220.118 35642 208.80.152.2 80 tcp http 0.120041 534 412 S1 - 0 ShADad 4 750 3 576 - -1300475168.892936 Tw8jXtpTGu6 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 - 0 ShADad 6 1468 4 950 - -1300475168.855305 3PKsZ2Uye21 141.142.220.118 49996 208.80.152.3 80 tcp http 0.218501 1171 733 S1 - 0 ShADad 6 1491 4 949 - -1300475168.892913 P654jzLoe3a 141.142.220.118 49999 208.80.152.3 80 tcp http 0.220961 1137 733 S1 - 0 ShADad 6 1457 4 949 - -1300475169.780331 2cx26uAvUPl 141.142.220.235 6705 173.192.163.128 80 tcp - - - - OTH - 0 h 0 0 1 48 - -1300475168.724007 j4u32Pc5bif 141.142.220.118 48649 208.80.152.118 80 tcp http 0.119905 525 232 S1 - 0 ShADad 4 741 3 396 - -1300475168.855330 VW0XPVINV8a 141.142.220.118 49997 208.80.152.3 80 tcp http 0.219720 1125 734 S1 - 0 ShADad 6 1445 4 950 - -#close 2013-05-05-20-51-24 diff --git a/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/http.log b/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/http.log deleted file mode 100644 index 617c1f0e6e..0000000000 --- a/testing/btest/Baseline/doc.manual.using_bro_sandbox_01/http.log +++ /dev/null @@ -1,23 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path http -#open 2013-05-05-21-12-40 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file -1300475168.784020 j4u32Pc5bif 141.142.220.118 48649 208.80.152.118 80 1 GET bits.wikimedia.org /skins-1.5/monobook/main.css http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.916018 VW0XPVINV8a 141.142.220.118 49997 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/6/63/Wikipedia-logo.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.916183 3PKsZ2Uye21 141.142.220.118 49996 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/b/bb/Wikipedia_wordmark.svg/174px-Wikipedia_wordmark.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.918358 GSxOnSLghOa 141.142.220.118 49998 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/b/bd/Bookshelf-40x201_6.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.952307 Tw8jXtpTGu6 141.142.220.118 50000 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/8/8a/Wikinews-logo.png/35px-Wikinews-logo.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.952296 P654jzLoe3a 141.142.220.118 49999 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/4/4a/Wiktionary-logo-en-35px.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.954820 0Q4FH8sESw5 141.142.220.118 50001 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/f/fa/Wikiquote-logo.svg/35px-Wikiquote-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.962687 i2rO3KD1Syg 141.142.220.118 35642 208.80.152.2 80 1 GET meta.wikimedia.org /images/wikimedia-button.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.975934 VW0XPVINV8a 141.142.220.118 49997 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/f/fa/Wikibooks-logo.svg/35px-Wikibooks-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.976436 3PKsZ2Uye21 141.142.220.118 49996 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/d/df/Wikispecies-logo.svg/35px-Wikispecies-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475168.979264 GSxOnSLghOa 141.142.220.118 49998 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/4/4c/Wikisource-logo.svg/35px-Wikisource-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475169.014619 Tw8jXtpTGu6 141.142.220.118 50000 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/4/4a/Commons-logo.svg/35px-Commons-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475169.014593 P654jzLoe3a 141.142.220.118 49999 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/9/91/Wikiversity-logo.svg/35px-Wikiversity-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -1300475169.014927 0Q4FH8sESw5 141.142.220.118 50001 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/7/75/Wikimedia_Community_Logo.svg/35px-Wikimedia_Community_Logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -#close 2013-05-05-21-12-40 diff --git a/testing/btest/Baseline/doc.manual.using_bro_sandbox_02/conn.log b/testing/btest/Baseline/doc.manual.using_bro_sandbox_02/conn.log deleted file mode 100644 index cc68286986..0000000000 --- a/testing/btest/Baseline/doc.manual.using_bro_sandbox_02/conn.log +++ /dev/null @@ -1,15 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path conn -#open 2013-05-07-14-38-27 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents -#types time string addr port addr port enum string interval count count string bool count string count count count count table[string] -1320329757.771503 j4u32Pc5bif 10.0.2.15 49286 192.150.187.43 80 tcp http 15.161537 2899 1127 S2 - 0 ShADadF 20 3719 19 1891 - -1320329757.771262 nQcgTWjvg4c 10.0.2.15 49285 192.150.187.43 80 tcp http 15.161772 889 377 S2 - 0 ShADadF 8 1229 8 701 - -1320329757.761327 arKYeMETxOg 10.0.2.15 49283 192.150.187.43 80 tcp http 15.168898 459 189 S2 - 0 ShADadF 5 679 4 353 - -1320329757.458867 UWkUyAuUGXf 10.0.2.15 49282 192.150.187.43 80 tcp http 15.471378 1824 751 S2 - 0 ShADadF 12 2324 13 1275 - -1320329757.761638 k6kgXLOoSKl 10.0.2.15 49284 192.150.187.43 80 tcp http 15.168613 898 376 S2 - 0 ShADadF 8 1238 8 700 - -1320329757.771755 TEfuqmmG4bh 10.0.2.15 49287 192.150.187.43 80 tcp http 15.161267 900 376 S2 - 0 ShADadF 8 1240 8 700 - -#close 2013-05-07-14-38-27 diff --git a/testing/btest/Baseline/doc.manual.using_bro_sandbox_02/http.log b/testing/btest/Baseline/doc.manual.using_bro_sandbox_02/http.log deleted file mode 100644 index 031a9ce2ce..0000000000 --- a/testing/btest/Baseline/doc.manual.using_bro_sandbox_02/http.log +++ /dev/null @@ -1,26 +0,0 @@ -#separator \x09 -#set_separator , -#empty_field (empty) -#unset_field - -#path http -#open 2013-05-07-14-38-27 -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port count string string string string string count count count string count string string table[enum] string string table[string] string string file -1320329757.460004 UWkUyAuUGXf 10.0.2.15 49282 192.150.187.43 80 1 GET bro-ids.org / - Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.772457 UWkUyAuUGXf 10.0.2.15 49282 192.150.187.43 80 2 GET bro-ids.org /css/pygments.css http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.874406 UWkUyAuUGXf 10.0.2.15 49282 192.150.187.43 80 3 GET bro-ids.org /js/jquery.zrssfeed.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.775110 k6kgXLOoSKl 10.0.2.15 49284 192.150.187.43 80 1 GET bro-ids.org /css/960.css http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.776072 TEfuqmmG4bh 10.0.2.15 49287 192.150.187.43 80 1 GET bro-ids.org /js/jquery.cycle.all.min.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.776421 nQcgTWjvg4c 10.0.2.15 49285 192.150.187.43 80 1 GET bro-ids.org /js/jquery.tweet.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.776240 j4u32Pc5bif 10.0.2.15 49286 192.150.187.43 80 1 GET bro-ids.org /js/jquery.fancybox-1.3.4.pack.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.775251 arKYeMETxOg 10.0.2.15 49283 192.150.187.43 80 1 GET bro-ids.org /css/bro-ids.css http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.975651 UWkUyAuUGXf 10.0.2.15 49282 192.150.187.43 80 4 GET bro-ids.org /js/jquery.tableofcontents.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.979943 k6kgXLOoSKl 10.0.2.15 49284 192.150.187.43 80 2 GET bro-ids.org /js/superfish.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.985656 TEfuqmmG4bh 10.0.2.15 49287 192.150.187.43 80 2 GET bro-ids.org /js/hoverIntent.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.989904 nQcgTWjvg4c 10.0.2.15 49285 192.150.187.43 80 2 GET bro-ids.org /js/general.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329757.991315 j4u32Pc5bif 10.0.2.15 49286 192.150.187.43 80 2 GET bro-ids.org /js/jquery.collapse.js http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329758.172397 j4u32Pc5bif 10.0.2.15 49286 192.150.187.43 80 3 GET bro-ids.org /css/print.css http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329759.998388 j4u32Pc5bif 10.0.2.15 49286 192.150.187.43 80 4 GET bro-ids.org /documentation/index.html http://bro-ids.org/ Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329760.146412 j4u32Pc5bif 10.0.2.15 49286 192.150.187.43 80 5 GET bro-ids.org /js/breadcrumbs.js http://bro-ids.org/documentation/index.html Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -1320329762.971726 j4u32Pc5bif 10.0.2.15 49286 192.150.187.43 80 6 GET bro-ids.org /documentation/reporting-problems.html http://bro-ids.org/documentation/index.html Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2 0 0 304 Not Modified - - - (empty) - - - - - - -#close 2013-05-07-14-38-27 diff --git a/testing/btest/Baseline/language.common-mistakes/1.out b/testing/btest/Baseline/language.common-mistakes/1.out index 6c5428605f..5371fc266f 100644 --- a/testing/btest/Baseline/language.common-mistakes/1.out +++ b/testing/btest/Baseline/language.common-mistakes/1.out @@ -1,4 +1,4 @@ expression error in ./1.zeek, line 9: field value missing (mr$f) bar start foo start -other bro_init +other zeek_init diff --git a/testing/btest/Baseline/language.event/out b/testing/btest/Baseline/language.event/out index 14fa9c1e8a..66f0ada96f 100644 --- a/testing/btest/Baseline/language.event/out +++ b/testing/btest/Baseline/language.event/out @@ -2,6 +2,6 @@ event statement event part1 event part2 assign event variable (6) -schedule statement in bro_init +schedule statement in zeek_init schedule statement in global -schedule statement another in bro_init +schedule statement another in zeek_init diff --git a/testing/btest/Baseline/language.index-assignment-invalid/out b/testing/btest/Baseline/language.index-assignment-invalid/out index 02dd4100ce..a30ecf891f 100644 --- a/testing/btest/Baseline/language.index-assignment-invalid/out +++ b/testing/btest/Baseline/language.index-assignment-invalid/out @@ -2,4 +2,4 @@ runtime error in /home/jon/pro/zeek/zeek/scripts/base/utils/queue.zeek, line 152 #0 Queue::get_vector([initialized=T, vals={[2] = test,[6] = jkl;,[4] = asdf,[1] = goodbye,[5] = 3,[0] = hello,[3] = [a=T, b=hi, c=]}, settings=[max_len=], top=7, bottom=0, size=0], [hello, goodbye, test]) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:19 #1 bar(55) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:27 #2 foo(hi, 13) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:39 - #3 bro_init() + #3 zeek_init() diff --git a/testing/btest/Baseline/language.returnwhen/bro..stdout b/testing/btest/Baseline/language.returnwhen/bro..stdout index d213d7bd02..969b6715af 100644 --- a/testing/btest/Baseline/language.returnwhen/bro..stdout +++ b/testing/btest/Baseline/language.returnwhen/bro..stdout @@ -1,6 +1,6 @@ -dummy from async_func() from bro_init() -async_func() return result in bro_init(), flag in my_set -dummy from bro_init() when block +dummy from async_func() from zeek_init() +async_func() return result in zeek_init(), flag in my_set +dummy from zeek_init() when block hi! dummy from async_func() from do_another() async_func() return result in do_another(), flag in my_set diff --git a/testing/btest/Baseline/language.zeek_init/out b/testing/btest/Baseline/language.zeek_init/out new file mode 100644 index 0000000000..aa17ec8aa8 --- /dev/null +++ b/testing/btest/Baseline/language.zeek_init/out @@ -0,0 +1,8 @@ +zeek_init at priority 10! +bro_init at priority 5! +zeek_init at priority 0! +bro_init at priority -10! +zeek_done at priority 10! +bro_done at priority 5! +zeek_done at priority 0! +bro_done at priority -10! diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index cd3ac7337f..27edb2b682 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -277,7 +277,7 @@ 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1555434070.553089, node=bro, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1555694513.545387, node=bro, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Broker::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) -> 0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Config::LOG)) -> @@ -462,7 +462,7 @@ 0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) -> 0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -> -0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1555434070.553089, node=bro, filter=ip or not ip, init=T, success=T])) -> +0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1555694513.545387, node=bro, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(NetControl::check_plugins, , ()) -> 0.000000 MetaHookPost CallFunction(NetControl::init, , ()) -> 0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) -> @@ -562,7 +562,6 @@ 0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugins, , ()) -> 0.000000 MetaHookPost CallFunction(Unified2::mappings_initialized, , ()) -> 0.000000 MetaHookPost CallFunction(Unified2::start_watching, , ()) -> -0.000000 MetaHookPost CallFunction(bro_init, , ()) -> 0.000000 MetaHookPost CallFunction(current_time, , ()) -> 0.000000 MetaHookPost CallFunction(filter_change_tracking, , ()) -> 0.000000 MetaHookPost CallFunction(getenv, , (BRO_DEFAULT_LISTEN_ADDRESS)) -> @@ -574,6 +573,7 @@ 0.000000 MetaHookPost CallFunction(set_to_regex, , ({}, (^\.?|\.)(~~)$)) -> 0.000000 MetaHookPost CallFunction(string_to_pattern, , ((^\.?|\.)()$, F)) -> 0.000000 MetaHookPost CallFunction(sub, , ((^\.?|\.)(~~)$, <...>/, )) -> +0.000000 MetaHookPost CallFunction(zeek_init, , ()) -> 0.000000 MetaHookPost DrainEvents() -> 0.000000 MetaHookPost LoadFile(0, ..<...>/main.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ..<...>/plugin.zeek) -> -1 @@ -899,8 +899,8 @@ 0.000000 MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true, packet_filter(0.0,0.0,0.0), 5, {ts (time), node (string), filter (string), init (bool), success (bool)}) -> 0.000000 MetaHookPost LogWrite(Log::WRITER_ASCII, default, packet_filter(0.0,0.0,0.0), 5, {ts (time), node (string), filter (string), init (bool), success (bool)}, ) -> true 0.000000 MetaHookPost QueueEvent(NetControl::init()) -> false -0.000000 MetaHookPost QueueEvent(bro_init()) -> false 0.000000 MetaHookPost QueueEvent(filter_change_tracking()) -> false +0.000000 MetaHookPost QueueEvent(zeek_init()) -> false 0.000000 MetaHookPre CallFunction(Analyzer::__disable_analyzer, , (Analyzer::ANALYZER_BACKDOOR)) 0.000000 MetaHookPre CallFunction(Analyzer::__disable_analyzer, , (Analyzer::ANALYZER_INTERCONN)) 0.000000 MetaHookPre CallFunction(Analyzer::__disable_analyzer, , (Analyzer::ANALYZER_STEPPINGSTONE)) @@ -1180,7 +1180,7 @@ 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1555434070.553089, node=bro, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1555694513.545387, node=bro, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Broker::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG)) 0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Config::LOG)) @@ -1365,7 +1365,7 @@ 0.000000 MetaHookPre CallFunction(Log::create_stream, , (Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509])) 0.000000 MetaHookPre CallFunction(Log::create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql])) -0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1555434070.553089, node=bro, filter=ip or not ip, init=T, success=T])) +0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1555694513.545387, node=bro, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(NetControl::check_plugins, , ()) 0.000000 MetaHookPre CallFunction(NetControl::init, , ()) 0.000000 MetaHookPre CallFunction(Notice::want_pp, , ()) @@ -1465,7 +1465,6 @@ 0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugins, , ()) 0.000000 MetaHookPre CallFunction(Unified2::mappings_initialized, , ()) 0.000000 MetaHookPre CallFunction(Unified2::start_watching, , ()) -0.000000 MetaHookPre CallFunction(bro_init, , ()) 0.000000 MetaHookPre CallFunction(current_time, , ()) 0.000000 MetaHookPre CallFunction(filter_change_tracking, , ()) 0.000000 MetaHookPre CallFunction(getenv, , (BRO_DEFAULT_LISTEN_ADDRESS)) @@ -1477,6 +1476,7 @@ 0.000000 MetaHookPre CallFunction(set_to_regex, , ({}, (^\.?|\.)(~~)$)) 0.000000 MetaHookPre CallFunction(string_to_pattern, , ((^\.?|\.)()$, F)) 0.000000 MetaHookPre CallFunction(sub, , ((^\.?|\.)(~~)$, <...>/, )) +0.000000 MetaHookPre CallFunction(zeek_init, , ()) 0.000000 MetaHookPre DrainEvents() 0.000000 MetaHookPre LoadFile(0, ..<...>/main.zeek) 0.000000 MetaHookPre LoadFile(0, ..<...>/plugin.zeek) @@ -1802,8 +1802,8 @@ 0.000000 MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true, packet_filter(0.0,0.0,0.0), 5, {ts (time), node (string), filter (string), init (bool), success (bool)}) 0.000000 MetaHookPre LogWrite(Log::WRITER_ASCII, default, packet_filter(0.0,0.0,0.0), 5, {ts (time), node (string), filter (string), init (bool), success (bool)}, ) 0.000000 MetaHookPre QueueEvent(NetControl::init()) -0.000000 MetaHookPre QueueEvent(bro_init()) 0.000000 MetaHookPre QueueEvent(filter_change_tracking()) +0.000000 MetaHookPre QueueEvent(zeek_init()) 0.000000 | HookCallFunction Analyzer::__disable_analyzer(Analyzer::ANALYZER_BACKDOOR) 0.000000 | HookCallFunction Analyzer::__disable_analyzer(Analyzer::ANALYZER_INTERCONN) 0.000000 | HookCallFunction Analyzer::__disable_analyzer(Analyzer::ANALYZER_STEPPINGSTONE) @@ -2082,7 +2082,7 @@ 0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1555434070.553089, node=bro, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1555694513.545387, node=bro, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction Log::add_default_filter(Broker::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG) 0.000000 | HookCallFunction Log::add_default_filter(Config::LOG) @@ -2267,7 +2267,7 @@ 0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=Weird::Info, ev=Weird::log_weird, path=weird]) 0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=X509::Info, ev=X509::log_x509, path=x509]) 0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql]) -0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1555434070.553089, node=bro, filter=ip or not ip, init=T, success=T]) +0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1555694513.545387, node=bro, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction NetControl::check_plugins() 0.000000 | HookCallFunction NetControl::init() 0.000000 | HookCallFunction Notice::want_pp() @@ -2367,7 +2367,6 @@ 0.000000 | HookCallFunction SumStats::register_observe_plugins() 0.000000 | HookCallFunction Unified2::mappings_initialized() 0.000000 | HookCallFunction Unified2::start_watching() -0.000000 | HookCallFunction bro_init() 0.000000 | HookCallFunction current_time() 0.000000 | HookCallFunction filter_change_tracking() 0.000000 | HookCallFunction getenv(BRO_DEFAULT_LISTEN_ADDRESS) @@ -2379,6 +2378,7 @@ 0.000000 | HookCallFunction set_to_regex({}, (^\.?|\.)(~~)$) 0.000000 | HookCallFunction string_to_pattern((^\.?|\.)()$, F) 0.000000 | HookCallFunction sub((^\.?|\.)(~~)$, <...>/, ) +0.000000 | HookCallFunction zeek_init() 0.000000 | HookDrainEvents 0.000000 | HookLoadFile ..<...>/main.zeek 0.000000 | HookLoadFile ..<...>/plugin.zeek @@ -2702,10 +2702,10 @@ 0.000000 | HookLoadFile base<...>/x509 0.000000 | HookLoadFile base<...>/xmpp 0.000000 | HookLogInit packet_filter 1/1 {ts (time), node (string), filter (string), init (bool), success (bool)} -0.000000 | HookLogWrite packet_filter [ts=1555434070.553089, node=bro, filter=ip or not ip, init=T, success=T] +0.000000 | HookLogWrite packet_filter [ts=1555694513.545387, node=bro, filter=ip or not ip, init=T, success=T] 0.000000 | HookQueueEvent NetControl::init() -0.000000 | HookQueueEvent bro_init() 0.000000 | HookQueueEvent filter_change_tracking() +0.000000 | HookQueueEvent zeek_init() 1362692526.869344 MetaHookPost BroObjDtor() -> 1362692526.869344 MetaHookPost CallFunction(ChecksumOffloading::check, , ()) -> 1362692526.869344 MetaHookPost CallFunction(NetControl::catch_release_seen, , (141.142.228.5)) -> @@ -3154,7 +3154,6 @@ 1362692527.080972 MetaHookPost CallFunction(KRB::fill_in_subjects, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> 1362692527.080972 MetaHookPost CallFunction(Log::__write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> 1362692527.080972 MetaHookPost CallFunction(Log::write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> -1362692527.080972 MetaHookPost CallFunction(bro_done, , ()) -> 1362692527.080972 MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> 1362692527.080972 MetaHookPost CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> 1362692527.080972 MetaHookPost CallFunction(filter_change_tracking, , ()) -> @@ -3169,14 +3168,15 @@ 1362692527.080972 MetaHookPost CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)) -> 1362692527.080972 MetaHookPost CallFunction(sub_bytes, , (HTTP, 0, 1)) -> 1362692527.080972 MetaHookPost CallFunction(to_lower, , (HTTP)) -> +1362692527.080972 MetaHookPost CallFunction(zeek_done, , ()) -> 1362692527.080972 MetaHookPost DrainEvents() -> 1362692527.080972 MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}) -> 1362692527.080972 MetaHookPost LogWrite(Log::WRITER_ASCII, default, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}, ) -> true 1362692527.080972 MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false -1362692527.080972 MetaHookPost QueueEvent(bro_done()) -> false 1362692527.080972 MetaHookPost QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false 1362692527.080972 MetaHookPost QueueEvent(filter_change_tracking()) -> false 1362692527.080972 MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false +1362692527.080972 MetaHookPost QueueEvent(zeek_done()) -> false 1362692527.080972 MetaHookPost UpdateNetworkTime(1362692527.080972) -> 1362692527.080972 MetaHookPre CallFunction(ChecksumOffloading::check, , ()) 1362692527.080972 MetaHookPre CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) @@ -3187,7 +3187,6 @@ 1362692527.080972 MetaHookPre CallFunction(KRB::fill_in_subjects, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre CallFunction(Log::__write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) 1362692527.080972 MetaHookPre CallFunction(Log::write, , (Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -1362692527.080972 MetaHookPre CallFunction(bro_done, , ()) 1362692527.080972 MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) 1362692527.080972 MetaHookPre CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre CallFunction(filter_change_tracking, , ()) @@ -3202,14 +3201,15 @@ 1362692527.080972 MetaHookPre CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80)) 1362692527.080972 MetaHookPre CallFunction(sub_bytes, , (HTTP, 0, 1)) 1362692527.080972 MetaHookPre CallFunction(to_lower, , (HTTP)) +1362692527.080972 MetaHookPre CallFunction(zeek_done, , ()) 1362692527.080972 MetaHookPre DrainEvents() 1362692527.080972 MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}) 1362692527.080972 MetaHookPre LogWrite(Log::WRITER_ASCII, default, conn(1362692527.080972,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}, ) 1362692527.080972 MetaHookPre QueueEvent(ChecksumOffloading::check()) -1362692527.080972 MetaHookPre QueueEvent(bro_done()) 1362692527.080972 MetaHookPre QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) 1362692527.080972 MetaHookPre QueueEvent(filter_change_tracking()) 1362692527.080972 MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +1362692527.080972 MetaHookPre QueueEvent(zeek_done()) 1362692527.080972 MetaHookPre UpdateNetworkTime(1362692527.080972) 1362692527.080972 | HookUpdateNetworkTime 1362692527.080972 1362692527.080972 | HookCallFunction ChecksumOffloading::check() @@ -3221,7 +3221,6 @@ 1362692527.080972 | HookCallFunction KRB::fill_in_subjects([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookCallFunction Log::__write(Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) 1362692527.080972 | HookCallFunction Log::write(Conn::LOG, [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) -1362692527.080972 | HookCallFunction bro_done() 1362692527.080972 | HookCallFunction cat(Analyzer::ANALYZER_HTTP, 1362692526.869344, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) 1362692527.080972 | HookCallFunction connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookCallFunction filter_change_tracking() @@ -3236,11 +3235,12 @@ 1362692527.080972 | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTP1362692526.869344T11141.142.228.5:59856 > 192.150.187.43:80) 1362692527.080972 | HookCallFunction sub_bytes(HTTP, 0, 1) 1362692527.080972 | HookCallFunction to_lower(HTTP) +1362692527.080972 | HookCallFunction zeek_done() 1362692527.080972 | HookDrainEvents 1362692527.080972 | HookLogInit conn 1/1 {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])} 1362692527.080972 | HookLogWrite conn [ts=1362692526.869344, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=] 1362692527.080972 | HookQueueEvent ChecksumOffloading::check() -1362692527.080972 | HookQueueEvent bro_done() 1362692527.080972 | HookQueueEvent connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) 1362692527.080972 | HookQueueEvent filter_change_tracking() 1362692527.080972 | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856<...>/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +1362692527.080972 | HookQueueEvent zeek_done() diff --git a/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events-no-args.log b/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events-no-args.log index b4be2cc92f..44e1435514 100644 --- a/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events-no-args.log +++ b/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events-no-args.log @@ -1,4 +1,4 @@ - 0.000000 bro_init + 0.000000 zeek_init 0.000000 NetControl::init 0.000000 filter_change_tracking 1254722767.492060 ChecksumOffloading::check @@ -226,5 +226,5 @@ 1437831800.217854 connection_state_remove 1437831800.217854 connection_pending 1437831800.217854 connection_state_remove -1437831800.217854 bro_done +1437831800.217854 zeek_done 1437831800.217854 ChecksumOffloading::check diff --git a/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log b/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log index 8f6550e2e2..9182b8f999 100644 --- a/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log +++ b/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log @@ -1,4 +1,4 @@ - 0.000000 bro_init + 0.000000 zeek_init 0.000000 NetControl::init 0.000000 filter_change_tracking 1254722767.492060 ChecksumOffloading::check @@ -1072,5 +1072,5 @@ 1437831800.217854 connection_state_remove [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=15, num_bytes_ip=2873, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0.756702, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=F1vce92FT1oRjKI328, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aMD5,\x0aSHA1,\x0aX509\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=, x509=[ts=1437831799.764576, id=F1vce92FT1oRjKI328, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=Fxp53s3wA5G3zdEJg8, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aMD5,\x0aSHA1,\x0aX509\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=, x509=[ts=1437831799.764576, id=Fxp53s3wA5G3zdEJg8, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[F1vce92FT1oRjKI328, Fxp53s3wA5G3zdEJg8], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 bro_done +1437831800.217854 zeek_done 1437831800.217854 ChecksumOffloading::check diff --git a/testing/btest/bifs/all_set.zeek b/testing/btest/bifs/all_set.zeek index 56f7b6e7f2..86a56ed9fa 100644 --- a/testing/btest/bifs/all_set.zeek +++ b/testing/btest/bifs/all_set.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = vector( T, F, T ); print all_set(a); diff --git a/testing/btest/bifs/analyzer_name.zeek b/testing/btest/bifs/analyzer_name.zeek index 266d1c159f..b763aabe08 100644 --- a/testing/btest/bifs/analyzer_name.zeek +++ b/testing/btest/bifs/analyzer_name.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = Analyzer::ANALYZER_PIA_TCP; print Analyzer::name(a); diff --git a/testing/btest/bifs/any_set.zeek b/testing/btest/bifs/any_set.zeek index b3e9e3c711..e19a467206 100644 --- a/testing/btest/bifs/any_set.zeek +++ b/testing/btest/bifs/any_set.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = vector( F, T, F ); print any_set(a); diff --git a/testing/btest/bifs/bloomfilter-seed.zeek b/testing/btest/bifs/bloomfilter-seed.zeek index 436638e2af..24531de915 100644 --- a/testing/btest/bifs/bloomfilter-seed.zeek +++ b/testing/btest/bifs/bloomfilter-seed.zeek @@ -34,7 +34,7 @@ function test_bloom_filter() } -event bro_init() +event zeek_init() { test_bloom_filter(); } diff --git a/testing/btest/bifs/bloomfilter.zeek b/testing/btest/bifs/bloomfilter.zeek index c0ccc2a552..dbad5acf5a 100644 --- a/testing/btest/bifs/bloomfilter.zeek +++ b/testing/btest/bifs/bloomfilter.zeek @@ -88,7 +88,7 @@ function test_counting_bloom_filter() print bloomfilter_lookup(bf_merged, "baz"); } -event bro_init() +event zeek_init() { test_basic_bloom_filter(); test_counting_bloom_filter(); diff --git a/testing/btest/bifs/bro_version.zeek b/testing/btest/bifs/bro_version.zeek index 35975559a5..f4de22e09d 100644 --- a/testing/btest/bifs/bro_version.zeek +++ b/testing/btest/bifs/bro_version.zeek @@ -1,7 +1,7 @@ # # @TEST-EXEC: bro -b %INPUT -event bro_init() +event zeek_init() { local a = bro_version(); if ( |a| == 0 ) diff --git a/testing/btest/bifs/bytestring_to_count.zeek b/testing/btest/bifs/bytestring_to_count.zeek index db50929cb7..5d15bde38b 100644 --- a/testing/btest/bifs/bytestring_to_count.zeek +++ b/testing/btest/bifs/bytestring_to_count.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { # unsupported byte lengths diff --git a/testing/btest/bifs/bytestring_to_double.zeek b/testing/btest/bifs/bytestring_to_double.zeek index 78820b207c..6ebcbe503b 100644 --- a/testing/btest/bifs/bytestring_to_double.zeek +++ b/testing/btest/bifs/bytestring_to_double.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local s1 = "\x43\x26\x4f\xa0\x71\x30\x80\x00"; # 3.14e15 local s2 = "\xc3\x26\x4f\xa0\x71\x30\x80\x00"; #-3.14e15 diff --git a/testing/btest/bifs/bytestring_to_hexstr.zeek b/testing/btest/bifs/bytestring_to_hexstr.zeek index 4087047f40..0b3e8154ab 100644 --- a/testing/btest/bifs/bytestring_to_hexstr.zeek +++ b/testing/btest/bifs/bytestring_to_hexstr.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print bytestring_to_hexstr("04"); print bytestring_to_hexstr(""); diff --git a/testing/btest/bifs/capture_state_updates.zeek b/testing/btest/bifs/capture_state_updates.zeek index 6a44e0f86f..17d015a661 100644 --- a/testing/btest/bifs/capture_state_updates.zeek +++ b/testing/btest/bifs/capture_state_updates.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: btest-diff out # @TEST-EXEC: test -f testfile -event bro_init() +event zeek_init() { print capture_state_updates("testfile"); } diff --git a/testing/btest/bifs/cat.zeek b/testing/btest/bifs/cat.zeek index e923d5d066..5e811f147e 100644 --- a/testing/btest/bifs/cat.zeek +++ b/testing/btest/bifs/cat.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "foo"; local b = 3; diff --git a/testing/btest/bifs/cat_string_array.zeek b/testing/btest/bifs/cat_string_array.zeek index e799f4b282..f9aa3f266d 100644 --- a/testing/btest/bifs/cat_string_array.zeek +++ b/testing/btest/bifs/cat_string_array.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a: string_array = { [0] = "this", [1] = "is", [2] = "a", [3] = "test" diff --git a/testing/btest/bifs/check_subnet.zeek b/testing/btest/bifs/check_subnet.zeek index b725cae73c..d476be1bc8 100644 --- a/testing/btest/bifs/check_subnet.zeek +++ b/testing/btest/bifs/check_subnet.zeek @@ -30,7 +30,7 @@ function check_member(s: subnet) } -event bro_init() +event zeek_init() { check_member(10.2.0.2/32); check_member(10.2.0.2/31); diff --git a/testing/btest/bifs/checkpoint_state.zeek b/testing/btest/bifs/checkpoint_state.zeek index 7a46516ba0..e9eeeccb75 100644 --- a/testing/btest/bifs/checkpoint_state.zeek +++ b/testing/btest/bifs/checkpoint_state.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT # @TEST-EXEC: test -f .state/state.bst -event bro_init() +event zeek_init() { local a = checkpoint_state(); if ( a != T ) diff --git a/testing/btest/bifs/clear_table.zeek b/testing/btest/bifs/clear_table.zeek index 9485eba1f5..a6c2e67341 100644 --- a/testing/btest/bifs/clear_table.zeek +++ b/testing/btest/bifs/clear_table.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT > out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local mytable: table[string] of string = { ["key1"] = "val1" }; diff --git a/testing/btest/bifs/convert_for_pattern.zeek b/testing/btest/bifs/convert_for_pattern.zeek index b99b010f97..1828284f37 100644 --- a/testing/btest/bifs/convert_for_pattern.zeek +++ b/testing/btest/bifs/convert_for_pattern.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print convert_for_pattern("foo"); print convert_for_pattern(""); diff --git a/testing/btest/bifs/count_to_addr.zeek b/testing/btest/bifs/count_to_addr.zeek index 993a701bc8..4abbaf8d1e 100644 --- a/testing/btest/bifs/count_to_addr.zeek +++ b/testing/btest/bifs/count_to_addr.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "1"; print count_to_v4_addr(to_count(a)); diff --git a/testing/btest/bifs/create_file.zeek b/testing/btest/bifs/create_file.zeek index af2cfb4979..db7d38d087 100644 --- a/testing/btest/bifs/create_file.zeek +++ b/testing/btest/bifs/create_file.zeek @@ -5,7 +5,7 @@ # @TEST-EXEC: btest-diff testfile2 # @TEST-EXEC: test -f testdir/testfile4 -event bro_init() +event zeek_init() { # Test that creating a file works as expected local a = open("testfile"); diff --git a/testing/btest/bifs/current_analyzer.zeek b/testing/btest/bifs/current_analyzer.zeek index e221d7aed0..8678907320 100644 --- a/testing/btest/bifs/current_analyzer.zeek +++ b/testing/btest/bifs/current_analyzer.zeek @@ -1,7 +1,7 @@ # # @TEST-EXEC: bro -b %INPUT -event bro_init() +event zeek_init() { local a = current_analyzer(); if ( a != 0 ) diff --git a/testing/btest/bifs/current_time.zeek b/testing/btest/bifs/current_time.zeek index 9d4899aa06..4d2712ae98 100644 --- a/testing/btest/bifs/current_time.zeek +++ b/testing/btest/bifs/current_time.zeek @@ -1,7 +1,7 @@ # # @TEST-EXEC: bro -b %INPUT -event bro_init() +event zeek_init() { local a = current_time(); if ( a <= double_to_time(0) ) diff --git a/testing/btest/bifs/directory_operations.zeek b/testing/btest/bifs/directory_operations.zeek index 9db34511b2..0a5a8b0413 100644 --- a/testing/btest/bifs/directory_operations.zeek +++ b/testing/btest/bifs/directory_operations.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { # Test succesful operations... print mkdir("testdir"); diff --git a/testing/btest/bifs/edit.zeek b/testing/btest/bifs/edit.zeek index 346c0bdbf7..ba6ebdef38 100644 --- a/testing/btest/bifs/edit.zeek +++ b/testing/btest/bifs/edit.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "hello there"; diff --git a/testing/btest/bifs/enable_raw_output.test b/testing/btest/bifs/enable_raw_output.test index ebaff36c8f..14bd2110ee 100644 --- a/testing/btest/bifs/enable_raw_output.test +++ b/testing/btest/bifs/enable_raw_output.test @@ -6,7 +6,7 @@ # @TEST-EXEC: btest-diff output # @TEST-EXEC: cmp myfile hookfile -event bro_init() +event zeek_init() { local myfile: file; myfile = open("myfile"); diff --git a/testing/btest/bifs/entropy_test.zeek b/testing/btest/bifs/entropy_test.zeek index 2a2dd422d1..11effd1159 100644 --- a/testing/btest/bifs/entropy_test.zeek +++ b/testing/btest/bifs/entropy_test.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "dh3Hie02uh^s#Sdf9L3frd243h$d78r2G4cM6*Q05d(7rh46f!0|4-f"; local handle = entropy_test_init(); diff --git a/testing/btest/bifs/enum_to_int.zeek b/testing/btest/bifs/enum_to_int.zeek index 3d577d2920..b48c925c8f 100644 --- a/testing/btest/bifs/enum_to_int.zeek +++ b/testing/btest/bifs/enum_to_int.zeek @@ -16,7 +16,7 @@ export { }; } -event bro_init() +event zeek_init() { diff --git a/testing/btest/bifs/escape_string.zeek b/testing/btest/bifs/escape_string.zeek index fd796497be..4ae79a869a 100644 --- a/testing/btest/bifs/escape_string.zeek +++ b/testing/btest/bifs/escape_string.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "Test \0string"; diff --git a/testing/btest/bifs/exit.zeek b/testing/btest/bifs/exit.zeek index b942a5e81c..03ea13efd3 100644 --- a/testing/btest/bifs/exit.zeek +++ b/testing/btest/bifs/exit.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out || test $? -eq 7 # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print "hello"; exit(7); diff --git a/testing/btest/bifs/file_mode.zeek b/testing/btest/bifs/file_mode.zeek index 62bee05c6c..de43439080 100644 --- a/testing/btest/bifs/file_mode.zeek +++ b/testing/btest/bifs/file_mode.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 420; # octal: 0644 print file_mode(a); diff --git a/testing/btest/bifs/filter_subnet_table.zeek b/testing/btest/bifs/filter_subnet_table.zeek index 7659096a71..79829bc252 100644 --- a/testing/btest/bifs/filter_subnet_table.zeek +++ b/testing/btest/bifs/filter_subnet_table.zeek @@ -32,7 +32,7 @@ global testb: table[subnet] of string = { }; -event bro_init() +event zeek_init() { local c = filter_subnet_table(10.2.0.2/32, testa); print c; diff --git a/testing/btest/bifs/find_all.zeek b/testing/btest/bifs/find_all.zeek index 4fe451a9d4..cb7e7b35d0 100644 --- a/testing/btest/bifs/find_all.zeek +++ b/testing/btest/bifs/find_all.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a test"; local pat = /hi|es/; diff --git a/testing/btest/bifs/find_entropy.zeek b/testing/btest/bifs/find_entropy.zeek index 2eb24fe118..771a6221f7 100644 --- a/testing/btest/bifs/find_entropy.zeek +++ b/testing/btest/bifs/find_entropy.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "dh3Hie02uh^s#Sdf9L3frd243h$d78r2G4cM6*Q05d(7rh46f!0|4-f"; local b = "0011000aaabbbbcccc000011111000000000aaaabbbbcccc0000000"; diff --git a/testing/btest/bifs/find_last.zeek b/testing/btest/bifs/find_last.zeek index 00ae2a874d..0eab201464 100644 --- a/testing/btest/bifs/find_last.zeek +++ b/testing/btest/bifs/find_last.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a test"; local pat = /hi|es/; diff --git a/testing/btest/bifs/fmt.zeek b/testing/btest/bifs/fmt.zeek index 7fc4dc38d7..979dbafe67 100644 --- a/testing/btest/bifs/fmt.zeek +++ b/testing/btest/bifs/fmt.zeek @@ -4,7 +4,7 @@ type color: enum { Red, Blue }; -event bro_init() +event zeek_init() { local a = Blue; local b = vector( 1, 2, 3); diff --git a/testing/btest/bifs/fmt_ftp_port.zeek b/testing/btest/bifs/fmt_ftp_port.zeek index 6a7b4d20c7..b265c0ad67 100644 --- a/testing/btest/bifs/fmt_ftp_port.zeek +++ b/testing/btest/bifs/fmt_ftp_port.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 192.168.0.2; local b = 257/tcp; diff --git a/testing/btest/bifs/get_matcher_stats.zeek b/testing/btest/bifs/get_matcher_stats.zeek index eeaa8cb86a..76d019caca 100644 --- a/testing/btest/bifs/get_matcher_stats.zeek +++ b/testing/btest/bifs/get_matcher_stats.zeek @@ -10,7 +10,7 @@ signature my_ftp_client { } @TEST-END-FILE -event bro_init() +event zeek_init() { local a = get_matcher_stats(); if ( a$matchers == 0 ) diff --git a/testing/btest/bifs/get_port_transport_proto.zeek b/testing/btest/bifs/get_port_transport_proto.zeek index ae3c496d88..18dfdd4974 100644 --- a/testing/btest/bifs/get_port_transport_proto.zeek +++ b/testing/btest/bifs/get_port_transport_proto.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 123/tcp; local b = 123/udp; diff --git a/testing/btest/bifs/gethostname.zeek b/testing/btest/bifs/gethostname.zeek index 1d760525cb..b30407190d 100644 --- a/testing/btest/bifs/gethostname.zeek +++ b/testing/btest/bifs/gethostname.zeek @@ -1,7 +1,7 @@ # # @TEST-EXEC: bro -b %INPUT -event bro_init() +event zeek_init() { local a = gethostname(); if ( |a| == 0 ) diff --git a/testing/btest/bifs/getpid.zeek b/testing/btest/bifs/getpid.zeek index 1852b1287e..a7348d4743 100644 --- a/testing/btest/bifs/getpid.zeek +++ b/testing/btest/bifs/getpid.zeek @@ -1,7 +1,7 @@ # # @TEST-EXEC: bro -b %INPUT -event bro_init() +event zeek_init() { local a = getpid(); if ( a == 0 ) diff --git a/testing/btest/bifs/getsetenv.zeek b/testing/btest/bifs/getsetenv.zeek index d217a14ea9..24fecb7800 100644 --- a/testing/btest/bifs/getsetenv.zeek +++ b/testing/btest/bifs/getsetenv.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: TESTBRO=testvalue bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = getenv("NOTDEFINED"); local b = getenv("TESTBRO"); diff --git a/testing/btest/bifs/global_ids.zeek b/testing/btest/bifs/global_ids.zeek index 2dcb6e844d..8875065b3b 100644 --- a/testing/btest/bifs/global_ids.zeek +++ b/testing/btest/bifs/global_ids.zeek @@ -2,13 +2,13 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = global_ids(); for ( i in a ) { # the table is quite large, so just print one item we expect - if ( i == "bro_init" ) + if ( i == "zeek_init" ) print a[i]$type_name; } diff --git a/testing/btest/bifs/global_sizes.zeek b/testing/btest/bifs/global_sizes.zeek index 4b0805172c..5705ae5e95 100644 --- a/testing/btest/bifs/global_sizes.zeek +++ b/testing/btest/bifs/global_sizes.zeek @@ -2,14 +2,14 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = global_sizes(); for ( i in a ) { # the table is quite large, so just look for one item we expect - if ( i == "bro_init" ) - print "found bro_init"; + if ( i == "zeek_init" ) + print "found zeek_init"; } diff --git a/testing/btest/bifs/haversine_distance.zeek b/testing/btest/bifs/haversine_distance.zeek index b0a87a2c2d..0d2e7891c0 100644 --- a/testing/btest/bifs/haversine_distance.zeek +++ b/testing/btest/bifs/haversine_distance.zeek @@ -7,7 +7,7 @@ function test(la1: double, lo1: double, la2: double, lo2: double) print fmt("%.4e", haversine_distance(la1, lo1, la2, lo2)); } -event bro_init() +event zeek_init() { # Test two arbitrary locations. test(37.866798, -122.253601, 48.25, 11.65); diff --git a/testing/btest/bifs/hexdump.zeek b/testing/btest/bifs/hexdump.zeek index 1c86ce0db8..10e1855a19 100644 --- a/testing/btest/bifs/hexdump.zeek +++ b/testing/btest/bifs/hexdump.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "abc\xffdefghijklmnopqrstuvwxyz"; diff --git a/testing/btest/bifs/hexstr_to_bytestring.zeek b/testing/btest/bifs/hexstr_to_bytestring.zeek index f0815a6269..0d41ca00a1 100644 --- a/testing/btest/bifs/hexstr_to_bytestring.zeek +++ b/testing/btest/bifs/hexstr_to_bytestring.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: btest-diff out # @TEST-EXEC: btest-diff .stderr -event bro_init() +event zeek_init() { print hexstr_to_bytestring("3034"); print hexstr_to_bytestring(""); diff --git a/testing/btest/bifs/hll_cardinality.zeek b/testing/btest/bifs/hll_cardinality.zeek index d1b0807416..6bb9c83708 100644 --- a/testing/btest/bifs/hll_cardinality.zeek +++ b/testing/btest/bifs/hll_cardinality.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: btest-diff out # @TEST-EXEC: btest-diff .stderr -event bro_init() +event zeek_init() { local c1 = hll_cardinality_init(0.01, 0.95); local c2 = hll_cardinality_init(0.01, 0.95); diff --git a/testing/btest/bifs/hll_large_estimate.zeek b/testing/btest/bifs/hll_large_estimate.zeek index b17b50678d..520b9633e3 100644 --- a/testing/btest/bifs/hll_large_estimate.zeek +++ b/testing/btest/bifs/hll_large_estimate.zeek @@ -6,7 +6,7 @@ # @TEST-EXEC: head -n1 out2 >> out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local cp: opaque of cardinality = hll_cardinality_init(0.1, 1.0); local base: count = 2130706432; # 127.0.0.0 diff --git a/testing/btest/bifs/identify_data.zeek b/testing/btest/bifs/identify_data.zeek index 048c409553..283c50fc86 100644 --- a/testing/btest/bifs/identify_data.zeek +++ b/testing/btest/bifs/identify_data.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT | sed 's/; charset=.*//g' >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { # plain text local a = "This is a test"; diff --git a/testing/btest/bifs/install_src_addr_filter.test b/testing/btest/bifs/install_src_addr_filter.test index 5b387832de..0ee0c85c43 100644 --- a/testing/btest/bifs/install_src_addr_filter.test +++ b/testing/btest/bifs/install_src_addr_filter.test @@ -1,7 +1,7 @@ # @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT >output # @TEST-EXEC: btest-diff output -event bro_init() +event zeek_init() { install_src_addr_filter(141.142.220.118, TH_SYN, 100.0); } diff --git a/testing/btest/bifs/is_ascii.zeek b/testing/btest/bifs/is_ascii.zeek index fa2d39d2d8..7930dafa58 100644 --- a/testing/btest/bifs/is_ascii.zeek +++ b/testing/btest/bifs/is_ascii.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a test\xfe"; local b = "this is a test\x7f"; diff --git a/testing/btest/bifs/is_local_interface.zeek b/testing/btest/bifs/is_local_interface.zeek index ac21b04bd3..8667babb85 100644 --- a/testing/btest/bifs/is_local_interface.zeek +++ b/testing/btest/bifs/is_local_interface.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print is_local_interface(127.0.0.1); print is_local_interface(1.2.3.4); diff --git a/testing/btest/bifs/is_port.zeek b/testing/btest/bifs/is_port.zeek index 2fe4964913..709c142070 100644 --- a/testing/btest/bifs/is_port.zeek +++ b/testing/btest/bifs/is_port.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 123/tcp; local b = 123/udp; diff --git a/testing/btest/bifs/join_string.zeek b/testing/btest/bifs/join_string.zeek index 0b2d94029a..1ea1afa5c2 100644 --- a/testing/btest/bifs/join_string.zeek +++ b/testing/btest/bifs/join_string.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a: string_array = { [1] = "this", [2] = "is", [3] = "a", [4] = "test" diff --git a/testing/btest/bifs/levenshtein_distance.zeek b/testing/btest/bifs/levenshtein_distance.zeek index 86d5e386f4..b877a68a22 100644 --- a/testing/btest/bifs/levenshtein_distance.zeek +++ b/testing/btest/bifs/levenshtein_distance.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a string"; local b = "this is a tring"; diff --git a/testing/btest/bifs/lookup_ID.zeek b/testing/btest/bifs/lookup_ID.zeek index e263c192da..1d11d1a8cb 100644 --- a/testing/btest/bifs/lookup_ID.zeek +++ b/testing/btest/bifs/lookup_ID.zeek @@ -4,7 +4,7 @@ global a = "bro test"; -event bro_init() +event zeek_init() { local b = "local value"; @@ -12,5 +12,5 @@ event bro_init() print lookup_ID(""); print lookup_ID("xyz"); print lookup_ID("b"); - print type_name( lookup_ID("bro_init") ); + print type_name( lookup_ID("zeek_init") ); } diff --git a/testing/btest/bifs/lowerupper.zeek b/testing/btest/bifs/lowerupper.zeek index 77e6b1c9d1..2cb04bfdaa 100644 --- a/testing/btest/bifs/lowerupper.zeek +++ b/testing/btest/bifs/lowerupper.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a Test"; diff --git a/testing/btest/bifs/lstrip.zeek b/testing/btest/bifs/lstrip.zeek index f382b06e23..850ec90d3f 100644 --- a/testing/btest/bifs/lstrip.zeek +++ b/testing/btest/bifs/lstrip.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local link_test = "https://www.zeek.org"; local one_side = "abcdcab"; diff --git a/testing/btest/bifs/matching_subnets.zeek b/testing/btest/bifs/matching_subnets.zeek index 87effed19f..3d38d32182 100644 --- a/testing/btest/bifs/matching_subnets.zeek +++ b/testing/btest/bifs/matching_subnets.zeek @@ -16,7 +16,7 @@ global testt: set[subnet] = { [2607:f8b0:4007:807::200e]/128 }; -event bro_init() +event zeek_init() { print testt; local c = matching_subnets(10.2.0.2/32, testt); diff --git a/testing/btest/bifs/math.zeek b/testing/btest/bifs/math.zeek index 84ace8620c..288838ffc1 100644 --- a/testing/btest/bifs/math.zeek +++ b/testing/btest/bifs/math.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 3.14; local b = 2.71; diff --git a/testing/btest/bifs/merge_pattern.zeek b/testing/btest/bifs/merge_pattern.zeek index de4a3afd6a..2d99137b56 100644 --- a/testing/btest/bifs/merge_pattern.zeek +++ b/testing/btest/bifs/merge_pattern.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = /foo/; local b = /b[a-z]+/; diff --git a/testing/btest/bifs/net_stats_trace.test b/testing/btest/bifs/net_stats_trace.test index cd9ee52a27..1cc1ba5567 100644 --- a/testing/btest/bifs/net_stats_trace.test +++ b/testing/btest/bifs/net_stats_trace.test @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -r $TRACES/wikipedia.trace >output %INPUT # @TEST-EXEC: btest-diff output -event bro_done() +event zeek_done() { print get_net_stats(); } diff --git a/testing/btest/bifs/netbios-functions.zeek b/testing/btest/bifs/netbios-functions.zeek index 9b075e8729..8e65f1d5ec 100644 --- a/testing/btest/bifs/netbios-functions.zeek +++ b/testing/btest/bifs/netbios-functions.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local names_to_decode = set( "ejfdebfeebfacacacacacacacacacaaa", # ISATAP diff --git a/testing/btest/bifs/order.zeek b/testing/btest/bifs/order.zeek index cb4b050686..34c8e8c101 100644 --- a/testing/btest/bifs/order.zeek +++ b/testing/btest/bifs/order.zeek @@ -20,7 +20,7 @@ function myfunc2(a: double, b: double): int return 1; } -event bro_init() +event zeek_init() { # Tests without supplying a comparison function diff --git a/testing/btest/bifs/parse_ftp.zeek b/testing/btest/bifs/parse_ftp.zeek index a8993fa6e0..1e982def27 100644 --- a/testing/btest/bifs/parse_ftp.zeek +++ b/testing/btest/bifs/parse_ftp.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print parse_ftp_port("192,168,0,2,1,1"); diff --git a/testing/btest/bifs/rand.zeek b/testing/btest/bifs/rand.zeek index caf3f16031..591f0bf035 100644 --- a/testing/btest/bifs/rand.zeek +++ b/testing/btest/bifs/rand.zeek @@ -6,7 +6,7 @@ const do_seed = T &redef; -event bro_init() +event zeek_init() { local a = rand(1000); local b = rand(1000); diff --git a/testing/btest/bifs/raw_bytes_to_v4_addr.zeek b/testing/btest/bifs/raw_bytes_to_v4_addr.zeek index bd685216ef..9ac266a0bd 100644 --- a/testing/btest/bifs/raw_bytes_to_v4_addr.zeek +++ b/testing/btest/bifs/raw_bytes_to_v4_addr.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print raw_bytes_to_v4_addr("ABCD"); print raw_bytes_to_v4_addr("ABC"); diff --git a/testing/btest/bifs/reading_traces.zeek b/testing/btest/bifs/reading_traces.zeek index 46ad04c25f..e6fa21999e 100644 --- a/testing/btest/bifs/reading_traces.zeek +++ b/testing/btest/bifs/reading_traces.zeek @@ -4,7 +4,7 @@ # @TEST-EXEC: bro -r $TRACES/web.trace %INPUT >out2 # @TEST-EXEC: btest-diff out2 -event bro_init() +event zeek_init() { print reading_traces(); } diff --git a/testing/btest/bifs/record_type_to_vector.zeek b/testing/btest/bifs/record_type_to_vector.zeek index 9795ce886b..e5e79a4f49 100644 --- a/testing/btest/bifs/record_type_to_vector.zeek +++ b/testing/btest/bifs/record_type_to_vector.zeek @@ -7,7 +7,7 @@ type myrecord: record { str1: string; }; -event bro_init() +event zeek_init() { print record_type_to_vector("myrecord"); } diff --git a/testing/btest/bifs/records_fields.zeek b/testing/btest/bifs/records_fields.zeek index 88df239b57..a130a63267 100644 --- a/testing/btest/bifs/records_fields.zeek +++ b/testing/btest/bifs/records_fields.zeek @@ -24,7 +24,7 @@ type r: record { type mystring: string; -event bro_init() +event zeek_init() { local x: r = [$a=42, $d="Bar", $e=tt]; print x; diff --git a/testing/btest/bifs/resize.zeek b/testing/btest/bifs/resize.zeek index f4067f31c7..97c3b8c20b 100644 --- a/testing/btest/bifs/resize.zeek +++ b/testing/btest/bifs/resize.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = vector( 5, 3, 8 ); diff --git a/testing/btest/bifs/reverse.zeek b/testing/btest/bifs/reverse.zeek index bbb386bb80..b6831ef3a7 100644 --- a/testing/btest/bifs/reverse.zeek +++ b/testing/btest/bifs/reverse.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local s1 = "hello world!"; local s2 = "rise to vote sir"; diff --git a/testing/btest/bifs/rotate_file.zeek b/testing/btest/bifs/rotate_file.zeek index a6109ff677..a7c3bf3971 100644 --- a/testing/btest/bifs/rotate_file.zeek +++ b/testing/btest/bifs/rotate_file.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = open("testfile"); write_file(a, "this is a test\n"); diff --git a/testing/btest/bifs/rotate_file_by_name.zeek b/testing/btest/bifs/rotate_file_by_name.zeek index f647edefe2..b02d4011be 100644 --- a/testing/btest/bifs/rotate_file_by_name.zeek +++ b/testing/btest/bifs/rotate_file_by_name.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = open("testfile"); write_file(a, "this is a test\n"); diff --git a/testing/btest/bifs/rstrip.zeek b/testing/btest/bifs/rstrip.zeek index a0695b8107..f99ebd5f8d 100644 --- a/testing/btest/bifs/rstrip.zeek +++ b/testing/btest/bifs/rstrip.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local link_test = "https://www.zeek.org"; local one_side = "abcdcab"; diff --git a/testing/btest/bifs/safe_shell_quote.zeek b/testing/btest/bifs/safe_shell_quote.zeek index 490952c79b..9f43fe4089 100644 --- a/testing/btest/bifs/safe_shell_quote.zeek +++ b/testing/btest/bifs/safe_shell_quote.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "echo `pwd` ${TEST} > \"my file\"; echo -e \"\\n\""; print a; diff --git a/testing/btest/bifs/same_object.zeek b/testing/btest/bifs/same_object.zeek index dddfd80d3d..8e38912f58 100644 --- a/testing/btest/bifs/same_object.zeek +++ b/testing/btest/bifs/same_object.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "This is a test"; local b: string; diff --git a/testing/btest/bifs/sort.zeek b/testing/btest/bifs/sort.zeek index 2ddb44b8be..2f3789c8a9 100644 --- a/testing/btest/bifs/sort.zeek +++ b/testing/btest/bifs/sort.zeek @@ -20,7 +20,7 @@ function myfunc2(a: double, b: double): int return 1; } -event bro_init() +event zeek_init() { # Tests without supplying a comparison function diff --git a/testing/btest/bifs/sort_string_array.zeek b/testing/btest/bifs/sort_string_array.zeek index 1916f93d0c..3d3949d89b 100644 --- a/testing/btest/bifs/sort_string_array.zeek +++ b/testing/btest/bifs/sort_string_array.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a: string_array = { [1] = "this", [2] = "is", [3] = "a", [4] = "test" diff --git a/testing/btest/bifs/split.zeek b/testing/btest/bifs/split.zeek index b117844645..2485c3af1f 100644 --- a/testing/btest/bifs/split.zeek +++ b/testing/btest/bifs/split.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a test"; local pat = /hi|es/; diff --git a/testing/btest/bifs/split_string.zeek b/testing/btest/bifs/split_string.zeek index e4d32b7f73..2f67921a04 100644 --- a/testing/btest/bifs/split_string.zeek +++ b/testing/btest/bifs/split_string.zeek @@ -8,7 +8,7 @@ function print_string_vector(v: string_vec) print v[i]; } -event bro_init() +event zeek_init() { local a = "this is a test"; local pat = /hi|es/; diff --git a/testing/btest/bifs/str_shell_escape.zeek b/testing/btest/bifs/str_shell_escape.zeek index e631458bc1..9079ef3953 100644 --- a/testing/btest/bifs/str_shell_escape.zeek +++ b/testing/btest/bifs/str_shell_escape.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "echo ${TEST} > \"my file\""; diff --git a/testing/btest/bifs/strcmp.zeek b/testing/btest/bifs/strcmp.zeek index 92d0430f1d..6893656e69 100644 --- a/testing/btest/bifs/strcmp.zeek +++ b/testing/btest/bifs/strcmp.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this"; local b = "testing"; diff --git a/testing/btest/bifs/strftime.zeek b/testing/btest/bifs/strftime.zeek index 3d9e388c90..8a9f42d8b3 100644 --- a/testing/btest/bifs/strftime.zeek +++ b/testing/btest/bifs/strftime.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local f1 = "%Y-%m-%d %H:%M:%S"; local f2 = "%H%M%S %Y%m%d"; diff --git a/testing/btest/bifs/string_fill.zeek b/testing/btest/bifs/string_fill.zeek index 0968215cc0..81a447ed47 100644 --- a/testing/btest/bifs/string_fill.zeek +++ b/testing/btest/bifs/string_fill.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "test "; diff --git a/testing/btest/bifs/string_to_pattern.zeek b/testing/btest/bifs/string_to_pattern.zeek index 4bd04bbcea..089cc3c557 100644 --- a/testing/btest/bifs/string_to_pattern.zeek +++ b/testing/btest/bifs/string_to_pattern.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print string_to_pattern("foo", F); print string_to_pattern("", F); diff --git a/testing/btest/bifs/strip.zeek b/testing/btest/bifs/strip.zeek index e508f20e3d..ae80811a30 100644 --- a/testing/btest/bifs/strip.zeek +++ b/testing/btest/bifs/strip.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = " this is a test "; local b = ""; diff --git a/testing/btest/bifs/strptime.zeek b/testing/btest/bifs/strptime.zeek index 215299b300..c8f57b1dfc 100644 --- a/testing/btest/bifs/strptime.zeek +++ b/testing/btest/bifs/strptime.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out 2>&1 # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print strptime("%Y-%m-%d", "2012-10-19"); print strptime("%m", "1980-10-24"); diff --git a/testing/btest/bifs/strstr.zeek b/testing/btest/bifs/strstr.zeek index 40cd8aa5fd..75a362375a 100644 --- a/testing/btest/bifs/strstr.zeek +++ b/testing/btest/bifs/strstr.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a test"; local b = "his"; diff --git a/testing/btest/bifs/sub.zeek b/testing/btest/bifs/sub.zeek index 773530ac74..f83113ad19 100644 --- a/testing/btest/bifs/sub.zeek +++ b/testing/btest/bifs/sub.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is a test"; local pat = /is|ss/; diff --git a/testing/btest/bifs/subst_string.zeek b/testing/btest/bifs/subst_string.zeek index 6ebed72321..186ca7f921 100644 --- a/testing/btest/bifs/subst_string.zeek +++ b/testing/btest/bifs/subst_string.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "this is another test"; local b = "is"; diff --git a/testing/btest/bifs/system.zeek b/testing/btest/bifs/system.zeek index bd27fc3db5..e488601ee5 100644 --- a/testing/btest/bifs/system.zeek +++ b/testing/btest/bifs/system.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = system("echo thistest > out"); if ( a != 0 ) diff --git a/testing/btest/bifs/system_env.zeek b/testing/btest/bifs/system_env.zeek index cfe4e7dd2a..beece2e2c6 100644 --- a/testing/btest/bifs/system_env.zeek +++ b/testing/btest/bifs/system_env.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT # @TEST-EXEC: btest-diff testfile -event bro_init() +event zeek_init() { local vars: table[string] of string = { ["TESTBRO"] = "helloworld" }; diff --git a/testing/btest/bifs/to_count.zeek b/testing/btest/bifs/to_count.zeek index 8de8c5c674..dc87fe94b9 100644 --- a/testing/btest/bifs/to_count.zeek +++ b/testing/btest/bifs/to_count.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a: int = -2; print int_to_count(a); diff --git a/testing/btest/bifs/to_double.zeek b/testing/btest/bifs/to_double.zeek index b6fb9917a7..b2d2d65f4d 100644 --- a/testing/btest/bifs/to_double.zeek +++ b/testing/btest/bifs/to_double.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 1 usec; print interval_to_double(a); diff --git a/testing/btest/bifs/to_int.zeek b/testing/btest/bifs/to_int.zeek index e65a555cc4..fe7d530835 100644 --- a/testing/btest/bifs/to_int.zeek +++ b/testing/btest/bifs/to_int.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print to_int("1"); print to_int("-1"); diff --git a/testing/btest/bifs/to_interval.zeek b/testing/btest/bifs/to_interval.zeek index 71d73fed62..b877cedacc 100644 --- a/testing/btest/bifs/to_interval.zeek +++ b/testing/btest/bifs/to_interval.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 1234563.14; print double_to_interval(a); diff --git a/testing/btest/bifs/to_port.zeek b/testing/btest/bifs/to_port.zeek index b2289b8a21..9c53de7297 100644 --- a/testing/btest/bifs/to_port.zeek +++ b/testing/btest/bifs/to_port.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { print to_port("123/tcp"); print to_port("123/udp"); diff --git a/testing/btest/bifs/to_time.zeek b/testing/btest/bifs/to_time.zeek index d5a81b0934..b286d92ea4 100644 --- a/testing/btest/bifs/to_time.zeek +++ b/testing/btest/bifs/to_time.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = 1234563.14; print double_to_time(a); diff --git a/testing/btest/bifs/topk.zeek b/testing/btest/bifs/topk.zeek index 1e650335a7..06246da4ac 100644 --- a/testing/btest/bifs/topk.zeek +++ b/testing/btest/bifs/topk.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: btest-diff out # @TEST-EXEC: btest-diff .stderr -event bro_init() +event zeek_init() { local k1 = topk_init(2); diff --git a/testing/btest/bifs/type_name.zeek b/testing/btest/bifs/type_name.zeek index f331fe6aa9..6f9f9c6f32 100644 --- a/testing/btest/bifs/type_name.zeek +++ b/testing/btest/bifs/type_name.zeek @@ -9,7 +9,7 @@ type myrecord: record { s: string; }; -event bro_init() +event zeek_init() { local a = "foo"; local b = 3; @@ -69,5 +69,5 @@ event bro_init() print type_name(y); # result is "file of string" which is a bit odd; # we should remove the (apparently unused) type argument # from files. - print type_name(bro_init); + print type_name(zeek_init); } diff --git a/testing/btest/bifs/uuid_to_string.zeek b/testing/btest/bifs/uuid_to_string.zeek index dc84f349fa..2df9d2f0f0 100644 --- a/testing/btest/bifs/uuid_to_string.zeek +++ b/testing/btest/bifs/uuid_to_string.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: bro -b %INPUT >out # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local a = "\xfe\x80abcdefg0123456"; print uuid_to_string(a); diff --git a/testing/btest/bifs/val_size.zeek b/testing/btest/bifs/val_size.zeek index 57b512b776..8757bde285 100644 --- a/testing/btest/bifs/val_size.zeek +++ b/testing/btest/bifs/val_size.zeek @@ -1,7 +1,7 @@ # # @TEST-EXEC: bro -b %INPUT -event bro_init() +event zeek_init() { local a = T; local b = 12; diff --git a/testing/btest/broker/connect-on-retry.zeek b/testing/btest/broker/connect-on-retry.zeek index 56df29cab1..ac5caffb69 100644 --- a/testing/btest/broker/connect-on-retry.zeek +++ b/testing/btest/broker/connect-on-retry.zeek @@ -16,7 +16,7 @@ global event_count = 0; global ping: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::auto_publish("bro/event/my_topic", ping); @@ -65,7 +65,7 @@ event delayed_listen() Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::auto_publish("bro/event/my_topic", pong); diff --git a/testing/btest/broker/disconnect.zeek b/testing/btest/broker/disconnect.zeek index 10a3fbfa69..7b4d2f7540 100644 --- a/testing/btest/broker/disconnect.zeek +++ b/testing/btest/broker/disconnect.zeek @@ -24,7 +24,7 @@ event my_event(i: count) print "sender got event", i; } -event bro_init() +event zeek_init() { Broker::subscribe(test_topic); Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -60,7 +60,7 @@ event my_event(i: count) terminate(); } -event bro_init() +event zeek_init() { Broker::subscribe(test_topic); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/broker/error.zeek b/testing/btest/broker/error.zeek index a3feac10fb..e6b902e6bb 100644 --- a/testing/btest/broker/error.zeek +++ b/testing/btest/broker/error.zeek @@ -27,7 +27,7 @@ event Broker::error(code: Broker::ErrorCode, msg: string) print "error", code, msg; } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); diff --git a/testing/btest/broker/remote_event.zeek b/testing/btest/broker/remote_event.zeek index 7a4ffec627..b160506f8f 100644 --- a/testing/btest/broker/remote_event.zeek +++ b/testing/btest/broker/remote_event.zeek @@ -15,7 +15,7 @@ global event_count = 0; global ping: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -64,7 +64,7 @@ global auto_handler: event(msg: string, c: count); global pong: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/broker/remote_event_any.zeek b/testing/btest/broker/remote_event_any.zeek index f0bb5713ca..b4df830195 100644 --- a/testing/btest/broker/remote_event_any.zeek +++ b/testing/btest/broker/remote_event_any.zeek @@ -15,7 +15,7 @@ global event_count = 0; global ping: event(msg: string, c: any); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -67,7 +67,7 @@ global auto_handler: event(msg: string, c: count); global pong: event(msg: string, c: any); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/broker/remote_event_auto.zeek b/testing/btest/broker/remote_event_auto.zeek index 9917be84f8..dde153d2ad 100644 --- a/testing/btest/broker/remote_event_auto.zeek +++ b/testing/btest/broker/remote_event_auto.zeek @@ -15,7 +15,7 @@ global event_count = 0; global ping: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::auto_publish("bro/event/my_topic", ping); @@ -59,7 +59,7 @@ global auto_handler: event(msg: string, c: count); global pong: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::auto_publish("bro/event/my_topic", pong); diff --git a/testing/btest/broker/remote_event_ssl_auth.zeek b/testing/btest/broker/remote_event_ssl_auth.zeek index d6c3d779ac..3e80a98b1e 100644 --- a/testing/btest/broker/remote_event_ssl_auth.zeek +++ b/testing/btest/broker/remote_event_ssl_auth.zeek @@ -174,7 +174,7 @@ global event_count = 0; global ping: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -225,7 +225,7 @@ global auto_handler: event(msg: string, c: count); global pong: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/broker/remote_event_vector_any.zeek b/testing/btest/broker/remote_event_vector_any.zeek index e0e3c9f879..93f667791d 100644 --- a/testing/btest/broker/remote_event_vector_any.zeek +++ b/testing/btest/broker/remote_event_vector_any.zeek @@ -20,7 +20,7 @@ type myrec: record { global bar: event(x: any); -event bro_init() +event zeek_init() { Broker::subscribe("test"); Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -91,7 +91,7 @@ event bar(x: any) process(x); } -event bro_init() +event zeek_init() { Broker::subscribe("test"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/broker/remote_id.zeek b/testing/btest/broker/remote_id.zeek index 52fc304364..a41675e5e8 100644 --- a/testing/btest/broker/remote_id.zeek +++ b/testing/btest/broker/remote_id.zeek @@ -10,7 +10,7 @@ const test_var = "init" &redef; -event bro_init() +event zeek_init() { Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); } @@ -44,7 +44,7 @@ event check_var() } } -event bro_init() +event zeek_init() { print "intial val", test_var; Broker::subscribe("bro/ids"); diff --git a/testing/btest/broker/remote_log.zeek b/testing/btest/broker/remote_log.zeek index 2274555cc7..2ab5d71343 100644 --- a/testing/btest/broker/remote_log.zeek +++ b/testing/btest/broker/remote_log.zeek @@ -25,7 +25,7 @@ export { }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Test::LOG, [$columns=Test::Info]); } @@ -42,7 +42,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) @load ./common -event bro_init() +event zeek_init() { Broker::subscribe("bro/"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -61,7 +61,7 @@ event Broker::peer_removed(endpoint: Broker::EndpointInfo, msg: string) @load ./common -event bro_init() +event zeek_init() { Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); } diff --git a/testing/btest/broker/remote_log_late_join.zeek b/testing/btest/broker/remote_log_late_join.zeek index 3b3666b98b..c199c19dcf 100644 --- a/testing/btest/broker/remote_log_late_join.zeek +++ b/testing/btest/broker/remote_log_late_join.zeek @@ -25,7 +25,7 @@ export { }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Test::LOG, [$columns=Test::Info]); } @@ -42,7 +42,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) @load ./common -event bro_init() +event zeek_init() { Broker::subscribe("bro/"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -68,7 +68,7 @@ event doconnect() global n = 0; -event bro_init() +event zeek_init() { schedule 2secs { doconnect() }; Log::write(Test::LOG, [$msg = "ping", $num = n]); diff --git a/testing/btest/broker/remote_log_types.zeek b/testing/btest/broker/remote_log_types.zeek index 2d7f56da92..153c1c27b3 100644 --- a/testing/btest/broker/remote_log_types.zeek +++ b/testing/btest/broker/remote_log_types.zeek @@ -47,7 +47,7 @@ export { } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Test::LOG, [$columns=Test::Info]); } @@ -58,7 +58,7 @@ event bro_init() &priority=5 @load ./common -event bro_init() +event zeek_init() { Broker::subscribe("bro/"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -77,7 +77,7 @@ event quit_receiver() @load ./common -event bro_init() +event zeek_init() { Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); } diff --git a/testing/btest/broker/ssl_auth_failure.zeek b/testing/btest/broker/ssl_auth_failure.zeek index 41c79236d4..737a8deccc 100644 --- a/testing/btest/broker/ssl_auth_failure.zeek +++ b/testing/btest/broker/ssl_auth_failure.zeek @@ -103,7 +103,7 @@ event do_terminate() terminate(); } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -145,7 +145,7 @@ event do_terminate() terminate(); } -event bro_init() +event zeek_init() { Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); schedule 10secs { do_terminate() }; diff --git a/testing/btest/broker/store/clone.zeek b/testing/btest/broker/store/clone.zeek index 25021a226f..2d68380ba1 100644 --- a/testing/btest/broker/store/clone.zeek +++ b/testing/btest/broker/store/clone.zeek @@ -48,7 +48,7 @@ event inserted() schedule 6secs { done() }; } -event bro_init() +event zeek_init() { Broker::auto_publish("bro/events", done); Broker::subscribe("bro/"); @@ -129,7 +129,7 @@ event lookup(stage: count) schedule 4sec { done() }; } -event bro_init() +event zeek_init() { Broker::auto_publish("bro/events", inserted); Broker::subscribe("bro/"); diff --git a/testing/btest/broker/store/local.zeek b/testing/btest/broker/store/local.zeek index b352df93f2..1846d8c2c3 100644 --- a/testing/btest/broker/store/local.zeek +++ b/testing/btest/broker/store/local.zeek @@ -13,7 +13,7 @@ event done() terminate(); } -event bro_init() +event zeek_init() { h = Broker::create_master("master"); Broker::put(h, "one", "110"); diff --git a/testing/btest/broker/store/ops.zeek b/testing/btest/broker/store/ops.zeek index 070a0f2ed3..4e89f365bf 100644 --- a/testing/btest/broker/store/ops.zeek +++ b/testing/btest/broker/store/ops.zeek @@ -83,7 +83,7 @@ event pk1() schedule 1sec { pk2() }; } -event bro_init() +event zeek_init() { h = Broker::create_master("master"); Broker::put(h, "one", "110"); diff --git a/testing/btest/broker/store/record.zeek b/testing/btest/broker/store/record.zeek index ab862012a6..62ee4735ba 100644 --- a/testing/btest/broker/store/record.zeek +++ b/testing/btest/broker/store/record.zeek @@ -8,7 +8,7 @@ type R: record { c: count; }; -event bro_init() +event zeek_init() { local cr = Broker::record_create(3); print Broker::record_size(cr); diff --git a/testing/btest/broker/store/set.zeek b/testing/btest/broker/store/set.zeek index 056b46e221..c2524cec6a 100644 --- a/testing/btest/broker/store/set.zeek +++ b/testing/btest/broker/store/set.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff master/out -event bro_init() +event zeek_init() { local cs = Broker::set_create(); diff --git a/testing/btest/broker/store/sqlite.zeek b/testing/btest/broker/store/sqlite.zeek index fbce1a693a..8adde597f5 100644 --- a/testing/btest/broker/store/sqlite.zeek +++ b/testing/btest/broker/store/sqlite.zeek @@ -27,7 +27,7 @@ event done() terminate(); } -event bro_init() +event zeek_init() { h = Broker::create_master("master", Broker::SQLITE); diff --git a/testing/btest/broker/store/table.zeek b/testing/btest/broker/store/table.zeek index 11bd00028b..6fdf7615a6 100644 --- a/testing/btest/broker/store/table.zeek +++ b/testing/btest/broker/store/table.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff master/out -event bro_init() +event zeek_init() { local ct = Broker::table_create(); diff --git a/testing/btest/broker/store/type-conversion.zeek b/testing/btest/broker/store/type-conversion.zeek index c92c1ea4c9..fa9e16d587 100644 --- a/testing/btest/broker/store/type-conversion.zeek +++ b/testing/btest/broker/store/type-conversion.zeek @@ -11,7 +11,7 @@ type R2: record { r1: R1; }; -event bro_init() +event zeek_init() { ### Print every broker data type print Broker::data_type(Broker::data(T)); diff --git a/testing/btest/broker/store/vector.zeek b/testing/btest/broker/store/vector.zeek index 7edc4ba050..7c44640334 100644 --- a/testing/btest/broker/store/vector.zeek +++ b/testing/btest/broker/store/vector.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff master/out -event bro_init() +event zeek_init() { local cv = Broker::vector_create(); print Broker::vector_size(cv); diff --git a/testing/btest/broker/unpeer.zeek b/testing/btest/broker/unpeer.zeek index 57bdf0301f..b03d53925e 100644 --- a/testing/btest/broker/unpeer.zeek +++ b/testing/btest/broker/unpeer.zeek @@ -34,7 +34,7 @@ event unpeer(endpoint: Broker::EndpointInfo) schedule 4secs { do_terminate() }; } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::auto_publish("bro/event/my_topic", print_something); @@ -65,7 +65,7 @@ event print_something(i: int) print "Something receiver", i; } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/core/discarder.zeek b/testing/btest/core/discarder.zeek index 71b78373e9..454d5a0de1 100644 --- a/testing/btest/core/discarder.zeek +++ b/testing/btest/core/discarder.zeek @@ -6,7 +6,7 @@ @TEST-START-FILE discarder-ip.zeek -event bro_init() +event zeek_init() { print "################ IP Discarder ################"; } @@ -28,7 +28,7 @@ event new_packet(c: connection, p: pkt_hdr) @TEST-START-FILE discarder-tcp.zeek -event bro_init() +event zeek_init() { print "################ TCP Discarder ################"; } @@ -50,7 +50,7 @@ event new_packet(c: connection, p: pkt_hdr) @TEST-START-FILE discarder-udp.zeek -event bro_init() +event zeek_init() { print "################ UDP Discarder ################"; } @@ -72,7 +72,7 @@ event new_packet(c: connection, p: pkt_hdr) @TEST-START-FILE discarder-icmp.zeek -event bro_init() +event zeek_init() { print "################ ICMP Discarder ################"; } diff --git a/testing/btest/core/div-by-zero.zeek b/testing/btest/core/div-by-zero.zeek index d1221638d6..da06569c2f 100644 --- a/testing/btest/core/div-by-zero.zeek +++ b/testing/btest/core/div-by-zero.zeek @@ -26,7 +26,7 @@ event mod_count(a: count, b: count) print a % b; } -event bro_init() +event zeek_init() { event div_int(10, 0); event div_count(10, 0); diff --git a/testing/btest/core/embedded-null.zeek b/testing/btest/core/embedded-null.zeek index 95a4c965a9..c85da21541 100644 --- a/testing/btest/core/embedded-null.zeek +++ b/testing/btest/core/embedded-null.zeek @@ -1,7 +1,7 @@ # @TEST-EXEC: bro -b %INPUT 2>&1 # @TEST-EXEC: btest-diff .stdout -event bro_init() +event zeek_init() { local a = "hi\x00there"; unique_id(a); diff --git a/testing/btest/core/event-arg-reuse.zeek b/testing/btest/core/event-arg-reuse.zeek index ba8e0f0677..3ad5f82cab 100644 --- a/testing/btest/core/event-arg-reuse.zeek +++ b/testing/btest/core/event-arg-reuse.zeek @@ -14,7 +14,7 @@ event f(a: int) &priority=-5 print "f2", a; } -event bro_init() +event zeek_init() { event f(1); } diff --git a/testing/btest/core/fake_dns.zeek b/testing/btest/core/fake_dns.zeek index f4d8c46777..f5cd4d2067 100644 --- a/testing/btest/core/fake_dns.zeek +++ b/testing/btest/core/fake_dns.zeek @@ -19,7 +19,7 @@ function check_terminate() terminate(); } -event bro_init() +event zeek_init() { print addrs; diff --git a/testing/btest/core/file-caching-serialization.test b/testing/btest/core/file-caching-serialization.test index 7ff1d8be8d..c6edeb55c2 100644 --- a/testing/btest/core/file-caching-serialization.test +++ b/testing/btest/core/file-caching-serialization.test @@ -42,7 +42,7 @@ event file_opened(f: file) print f, "opened"; } -event bro_init() +event zeek_init() { for ( i in iterations ) write_to_file(iterations[i]); diff --git a/testing/btest/core/global_opaque_val.zeek b/testing/btest/core/global_opaque_val.zeek index 84087d8295..0232271ced 100644 --- a/testing/btest/core/global_opaque_val.zeek +++ b/testing/btest/core/global_opaque_val.zeek @@ -3,7 +3,7 @@ global test = md5_hash_init(); -event bro_init() +event zeek_init() { md5_hash_update(test, "one"); md5_hash_update(test, "two"); diff --git a/testing/btest/core/init-error.zeek b/testing/btest/core/init-error.zeek index c415ca16b1..858fad4eb1 100644 --- a/testing/btest/core/init-error.zeek +++ b/testing/btest/core/init-error.zeek @@ -3,19 +3,19 @@ # @TEST-EXEC-FAIL: unset ZEEK_ALLOW_INIT_ERRORS && bro -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out -event bro_init() &priority=10 +event zeek_init() &priority=10 { print "1st event"; } -event bro_init() &priority=10 +event zeek_init() &priority=10 { print "2nd event"; local v = vector(1, 2, 3); print v[10]; } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { print "3rd event"; } diff --git a/testing/btest/core/leaks/basic-cluster.zeek b/testing/btest/core/leaks/basic-cluster.zeek index 7e08756bb7..e186b7aa43 100644 --- a/testing/btest/core/leaks/basic-cluster.zeek +++ b/testing/btest/core/leaks/basic-cluster.zeek @@ -24,7 +24,7 @@ redef Log::default_rotation_interval = 0secs; global n = 0; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test", $apply=set(SumStats::SUM, SumStats::MIN, SumStats::MAX, SumStats::AVERAGE, SumStats::STD_DEV, SumStats::VARIANCE, SumStats::UNIQUE)]; SumStats::create([$name="test", @@ -48,7 +48,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) global ready_for_data: event(); -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, ready_for_data); } diff --git a/testing/btest/core/leaks/broker/clone_store.zeek b/testing/btest/core/leaks/broker/clone_store.zeek index 9dc9b6072c..a1f1256551 100644 --- a/testing/btest/core/leaks/broker/clone_store.zeek +++ b/testing/btest/core/leaks/broker/clone_store.zeek @@ -49,7 +49,7 @@ event inserted() schedule 2secs { done() }; } -event bro_init() +event zeek_init() { Broker::auto_publish("bro/events", done); Broker::subscribe("bro/"); @@ -127,7 +127,7 @@ event done() terminate(); } -event bro_init() +event zeek_init() { Broker::auto_publish("bro/events", inserted); Broker::subscribe("bro/"); diff --git a/testing/btest/core/leaks/broker/master_store.zeek b/testing/btest/core/leaks/broker/master_store.zeek index 583f80413b..08919bb461 100644 --- a/testing/btest/core/leaks/broker/master_store.zeek +++ b/testing/btest/core/leaks/broker/master_store.zeek @@ -85,7 +85,7 @@ event pk1() schedule 1sec { pk2() }; } -event bro_init() +event zeek_init() { h = Broker::create_master("master"); Broker::put(h, "one", "110"); diff --git a/testing/btest/core/leaks/broker/remote_event.test b/testing/btest/core/leaks/broker/remote_event.test index 972f8cbf93..9983f7871d 100644 --- a/testing/btest/core/leaks/broker/remote_event.test +++ b/testing/btest/core/leaks/broker/remote_event.test @@ -16,7 +16,7 @@ redef exit_only_after_terminate = T; global event_handler: event(msg: string, c: count); global auto_event_handler: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/"); Broker::auto_publish("bro/event/my_topic", auto_event_handler); @@ -50,7 +50,7 @@ redef exit_only_after_terminate = T; global event_handler: event(msg: string, c: count); global auto_event_handler: event(msg: string, c: count); -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/my_topic"); Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT")), 1secs); diff --git a/testing/btest/core/leaks/broker/remote_log.test b/testing/btest/core/leaks/broker/remote_log.test index 5f41ba9682..21d387b15f 100644 --- a/testing/btest/core/leaks/broker/remote_log.test +++ b/testing/btest/core/leaks/broker/remote_log.test @@ -27,7 +27,7 @@ export { }; } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(Test::LOG, [$columns=Test::Info]); } @@ -43,7 +43,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) @load ./common -event bro_init() +event zeek_init() { Broker::subscribe("bro/"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); @@ -60,7 +60,7 @@ event Broker::peer_removed(endpoint: Broker::EndpointInfo, msg: string) @load ./common -event bro_init() +event zeek_init() { Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT"))); } diff --git a/testing/btest/core/leaks/exec.test b/testing/btest/core/leaks/exec.test index a859c4d4c3..ec4eb0d75f 100644 --- a/testing/btest/core/leaks/exec.test +++ b/testing/btest/core/leaks/exec.test @@ -31,7 +31,7 @@ function test_cmd(label: string, cmd: Exec::Command) } } -event bro_init() +event zeek_init() { test_cmd("test1", [$cmd="bash ../somescript.sh", $read_files=set("out1", "out2")]); diff --git a/testing/btest/core/leaks/hll_cluster.zeek b/testing/btest/core/leaks/hll_cluster.zeek index 613e458985..40f964ad3a 100644 --- a/testing/btest/core/leaks/hll_cluster.zeek +++ b/testing/btest/core/leaks/hll_cluster.zeek @@ -31,7 +31,7 @@ global hll_data: event(data: opaque of cardinality); @if ( Cluster::local_node_type() == Cluster::WORKER ) -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::manager_topic, hll_data); } @@ -94,7 +94,7 @@ event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string) global result_count = 0; global hll: opaque of cardinality; -event bro_init() +event zeek_init() { hll = hll_cardinality_init(0.01, 0.95); } diff --git a/testing/btest/core/leaks/input-basic.zeek b/testing/btest/core/leaks/input-basic.zeek index 2f2ecf802d..177cbc5e26 100644 --- a/testing/btest/core/leaks/input-basic.zeek +++ b/testing/btest/core/leaks/input-basic.zeek @@ -50,7 +50,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/core/leaks/input-errors.zeek b/testing/btest/core/leaks/input-errors.zeek index 589579779f..93a143c8d5 100644 --- a/testing/btest/core/leaks/input-errors.zeek +++ b/testing/btest/core/leaks/input-errors.zeek @@ -152,7 +152,7 @@ event kill_me() terminate(); } -event bro_init() +event zeek_init() { outfile = open("out"); Input::add_event([$source="input.log", $name="file", $fields=FileVal, $ev=line_file, $want_record=T]); diff --git a/testing/btest/core/leaks/input-missing-enum.zeek b/testing/btest/core/leaks/input-missing-enum.zeek index 9037e15ed0..5f931a35f3 100644 --- a/testing/btest/core/leaks/input-missing-enum.zeek +++ b/testing/btest/core/leaks/input-missing-enum.zeek @@ -26,7 +26,7 @@ type Val: record { global etable: table[int] of Log::ID = table(); -event bro_init() +event zeek_init() { # first read in the old stuff into the table... Input::add_table([$source="../input.log", $name="enum", $idx=Idx, $val=Val, $destination=etable, $want_record=F]); diff --git a/testing/btest/core/leaks/input-optional-event.zeek b/testing/btest/core/leaks/input-optional-event.zeek index ca141e1c4e..df8d591769 100644 --- a/testing/btest/core/leaks/input-optional-event.zeek +++ b/testing/btest/core/leaks/input-optional-event.zeek @@ -50,7 +50,7 @@ event servers(desc: Input::EventDescription, tpe: Input::Event, item: Val) print outfile, item; } -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/core/leaks/input-optional-table.zeek b/testing/btest/core/leaks/input-optional-table.zeek index 95871b1516..f3e4c05fb4 100644 --- a/testing/btest/core/leaks/input-optional-table.zeek +++ b/testing/btest/core/leaks/input-optional-table.zeek @@ -50,7 +50,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/core/leaks/input-raw.zeek b/testing/btest/core/leaks/input-raw.zeek index 608ea25030..39ab13adfd 100644 --- a/testing/btest/core/leaks/input-raw.zeek +++ b/testing/btest/core/leaks/input-raw.zeek @@ -63,7 +63,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) } } -event bro_init() +event zeek_init() { outfile = open("../out"); try = 0; diff --git a/testing/btest/core/leaks/input-reread.zeek b/testing/btest/core/leaks/input-reread.zeek index 8b6295c15d..c15a91a6aa 100644 --- a/testing/btest/core/leaks/input-reread.zeek +++ b/testing/btest/core/leaks/input-reread.zeek @@ -118,7 +118,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r print outfile, right; } -event bro_init() +event zeek_init() { outfile = open("../out"); try = 0; diff --git a/testing/btest/core/leaks/input-sqlite.zeek b/testing/btest/core/leaks/input-sqlite.zeek index ae1df163c8..d278a00533 100644 --- a/testing/btest/core/leaks/input-sqlite.zeek +++ b/testing/btest/core/leaks/input-sqlite.zeek @@ -87,7 +87,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, r: Conn::Inf print outfile, |r$tunnel_parents|; # to make sure I got empty right } -event bro_init() +event zeek_init() { local config_strings: table[string] of string = { ["query"] = "select * from conn;", diff --git a/testing/btest/core/leaks/input-with-remove.zeek b/testing/btest/core/leaks/input-with-remove.zeek index ba58d7b2f6..59e3f28c0a 100644 --- a/testing/btest/core/leaks/input-with-remove.zeek +++ b/testing/btest/core/leaks/input-with-remove.zeek @@ -52,7 +52,7 @@ event do_term() { terminate(); } -event bro_init() { +event zeek_init() { schedule 1sec { do() }; diff --git a/testing/btest/core/leaks/returnwhen.zeek b/testing/btest/core/leaks/returnwhen.zeek index f5160ef250..1220a3c371 100644 --- a/testing/btest/core/leaks/returnwhen.zeek +++ b/testing/btest/core/leaks/returnwhen.zeek @@ -63,7 +63,7 @@ event do_another() } } -event bro_init() +event zeek_init() { local local_dummy = dummyfunc; @@ -71,10 +71,10 @@ event bro_init() schedule 1sec { set_flag() }; - when ( local result = async_func("from bro_init()") ) + when ( local result = async_func("from zeek_init()") ) { - print "async_func() return result in bro_init()", result; - print local_dummy("from bro_init() when block"); + print "async_func() return result in zeek_init()", result; + print local_dummy("from zeek_init() when block"); print anon("hi"); if ( result == "timeout" ) terminate(); schedule 10msec { do_another() }; diff --git a/testing/btest/core/load-explicit-bro-suffix-fallback.zeek b/testing/btest/core/load-explicit-bro-suffix-fallback.zeek index 28f770ca48..689be5bc03 100644 --- a/testing/btest/core/load-explicit-bro-suffix-fallback.zeek +++ b/testing/btest/core/load-explicit-bro-suffix-fallback.zeek @@ -5,7 +5,7 @@ @load foo.bro @TEST-START-FILE foo.zeek -event bro_init() +event zeek_init() { print "loaded foo.zeek"; } diff --git a/testing/btest/core/old_comm_usage.zeek b/testing/btest/core/old_comm_usage.zeek index 0e9ae2f1f6..8f4e3854aa 100644 --- a/testing/btest/core/old_comm_usage.zeek +++ b/testing/btest/core/old_comm_usage.zeek @@ -1,7 +1,7 @@ # @TEST-EXEC-FAIL: bro -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out -event bro_init() +event zeek_init() { terminate_communication(); } diff --git a/testing/btest/core/option-priorities.zeek b/testing/btest/core/option-priorities.zeek index fd352a5459..088d82ea9f 100644 --- a/testing/btest/core/option-priorities.zeek +++ b/testing/btest/core/option-priorities.zeek @@ -16,7 +16,7 @@ function option_changed_two(ID: string, new_value: bool, location: string): bool return T; } -event bro_init() +event zeek_init() { print "Old value", testbool; Option::set_change_handler("testbool", option_changed); diff --git a/testing/btest/core/option-redef.zeek b/testing/btest/core/option-redef.zeek index 3d67a9a755..30d381306a 100644 --- a/testing/btest/core/option-redef.zeek +++ b/testing/btest/core/option-redef.zeek @@ -9,7 +9,7 @@ redef testopt = 6; option anotheropt = 6; redef anotheropt = 7; -event bro_init() { +event zeek_init() { print testopt; print anotheropt; } diff --git a/testing/btest/core/pcap/dynamic-filter.zeek b/testing/btest/core/pcap/dynamic-filter.zeek index c1b48155c1..caebaf0558 100644 --- a/testing/btest/core/pcap/dynamic-filter.zeek +++ b/testing/btest/core/pcap/dynamic-filter.zeek @@ -21,7 +21,7 @@ event new_packet(c: connection, p: pkt_hdr) print "error 4"; } -event bro_init() +event zeek_init() { if ( ! Pcap::precompile_pcap_filter(A, "port 80") ) print "error 1"; diff --git a/testing/btest/core/pcap/filter-error.zeek b/testing/btest/core/pcap/filter-error.zeek index 10270ed53f..b83b8879a0 100644 --- a/testing/btest/core/pcap/filter-error.zeek +++ b/testing/btest/core/pcap/filter-error.zeek @@ -7,7 +7,7 @@ redef enum PcapFilterID += { A }; -event bro_init() +event zeek_init() { if ( ! Pcap::precompile_pcap_filter(A, "kaputt, too") ) print "error", Pcap::error(); diff --git a/testing/btest/core/pcap/input-error.zeek b/testing/btest/core/pcap/input-error.zeek index 44788b3391..5e469e08e8 100644 --- a/testing/btest/core/pcap/input-error.zeek +++ b/testing/btest/core/pcap/input-error.zeek @@ -5,7 +5,7 @@ redef enum PcapFilterID += { A }; -event bro_init() +event zeek_init() { if ( ! Pcap::precompile_pcap_filter(A, "kaputt, too") ) print "error", Pcap::error(); diff --git a/testing/btest/core/pcap/pseudo-realtime.zeek b/testing/btest/core/pcap/pseudo-realtime.zeek index 625706f321..c51b5cc32b 100644 --- a/testing/btest/core/pcap/pseudo-realtime.zeek +++ b/testing/btest/core/pcap/pseudo-realtime.zeek @@ -31,7 +31,7 @@ event new_packet(c: connection, p: pkt_hdr) # print fmt("num=%d agg_delta_network=%.1f agg_delta_real=%.1f", cnt, an, ac); } -event bro_done() +event zeek_done() { local d = (an - ac); if ( d < 0 secs) diff --git a/testing/btest/core/reassembly.zeek b/testing/btest/core/reassembly.zeek index 30cfaa727e..53489008de 100644 --- a/testing/btest/core/reassembly.zeek +++ b/testing/btest/core/reassembly.zeek @@ -5,7 +5,7 @@ # @TEST-EXEC: bro -C -r $TRACES/tcp/reassembly.pcap %INPUT >>output # @TEST-EXEC: btest-diff output -event bro_init() +event zeek_init() { print "----------------------"; } diff --git a/testing/btest/core/recursive-event.zeek b/testing/btest/core/recursive-event.zeek index 245e994cd6..63cb05eb6f 100644 --- a/testing/btest/core/recursive-event.zeek +++ b/testing/btest/core/recursive-event.zeek @@ -26,7 +26,7 @@ event test() event test(); } -event bro_init() +event zeek_init() { event test(); } diff --git a/testing/btest/core/reporter-error-in-handler.zeek b/testing/btest/core/reporter-error-in-handler.zeek index c4a21d5902..fc0517ab2a 100644 --- a/testing/btest/core/reporter-error-in-handler.zeek +++ b/testing/btest/core/reporter-error-in-handler.zeek @@ -23,7 +23,7 @@ event reporter_error(t: time, msg: string, location: string) } } -event bro_init() +event zeek_init() { print a[1]; } diff --git a/testing/btest/core/reporter-fmt-strings.zeek b/testing/btest/core/reporter-fmt-strings.zeek index 0e0be77844..09c03cf721 100644 --- a/testing/btest/core/reporter-fmt-strings.zeek +++ b/testing/btest/core/reporter-fmt-strings.zeek @@ -4,7 +4,7 @@ # @TEST-EXEC-FAIL: bro %INPUT >output 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output -event bro_init() +event zeek_init() { event dont_interpret_this("%s"); } diff --git a/testing/btest/core/reporter-parse-error.zeek b/testing/btest/core/reporter-parse-error.zeek index 25f33e2785..d57917ff26 100644 --- a/testing/btest/core/reporter-parse-error.zeek +++ b/testing/btest/core/reporter-parse-error.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC-FAIL: bro %INPUT >output 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output -event bro_init() +event zeek_init() { print TESTFAILURE; } diff --git a/testing/btest/core/reporter-runtime-error.zeek b/testing/btest/core/reporter-runtime-error.zeek index f8dd8c504c..9caeddb258 100644 --- a/testing/btest/core/reporter-runtime-error.zeek +++ b/testing/btest/core/reporter-runtime-error.zeek @@ -4,7 +4,7 @@ global a: table[count] of count; -event bro_init() +event zeek_init() { print a[2]; } diff --git a/testing/btest/core/reporter-type-mismatch.zeek b/testing/btest/core/reporter-type-mismatch.zeek index 0faa9b85e2..1a375ea84b 100644 --- a/testing/btest/core/reporter-type-mismatch.zeek +++ b/testing/btest/core/reporter-type-mismatch.zeek @@ -6,7 +6,7 @@ event foo(a: string) { } -event bro_init() +event zeek_init() { event foo(42); } diff --git a/testing/btest/core/reporter.zeek b/testing/btest/core/reporter.zeek index aa660ef495..bc79ca73d8 100644 --- a/testing/btest/core/reporter.zeek +++ b/testing/btest/core/reporter.zeek @@ -3,14 +3,14 @@ # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff logger-test.log -event bro_init() +event zeek_init() { Reporter::info("init test-info"); Reporter::warning("init test-warning"); Reporter::error("init test-error"); } -event bro_done() +event zeek_done() { Reporter::info("done test-info"); Reporter::warning("done test-warning"); diff --git a/testing/btest/core/vector-assignment.zeek b/testing/btest/core/vector-assignment.zeek index d1f02c124f..9c5cc4e0f6 100644 --- a/testing/btest/core/vector-assignment.zeek +++ b/testing/btest/core/vector-assignment.zeek @@ -13,7 +13,7 @@ function set_me(val: any) { print a; } -event bro_init() { +event zeek_init() { local b: vector of count = {1, 2, 3}; set_me(b); } diff --git a/testing/btest/core/when-interpreter-exceptions.zeek b/testing/btest/core/when-interpreter-exceptions.zeek index f259a46bda..41f2374c2f 100644 --- a/testing/btest/core/when-interpreter-exceptions.zeek +++ b/testing/btest/core/when-interpreter-exceptions.zeek @@ -79,9 +79,9 @@ function g(do_exception: bool): bool return F; } -event bro_init() +event zeek_init() { - local cmd = Exec::Command($cmd="echo 'bro_init()'"); + local cmd = Exec::Command($cmd="echo 'zeek_init()'"); local stall = Exec::Command($cmd="sleep 30"); when ( local result = Exec::run(cmd) ) diff --git a/testing/btest/coverage/broxygen.sh b/testing/btest/coverage/broxygen.sh index 13bf24bce3..eee4575738 100644 --- a/testing/btest/coverage/broxygen.sh +++ b/testing/btest/coverage/broxygen.sh @@ -2,7 +2,7 @@ # loadable script is referenced there. The only additional check here is # that the broxygen package should even load scripts that are commented # out in test-all-policy.bro because the broxygen package is only loaded -# when generated documentation and will terminate has soon as bro_init +# when generated documentation and will terminate has soon as zeek_init # is handled, even if a script will e.g. put Bro into listen mode or otherwise # cause it to not terminate after scripts are parsed. diff --git a/testing/btest/doc/broxygen/all_scripts.test b/testing/btest/doc/broxygen/all_scripts.test deleted file mode 100644 index 238ba3a4f3..0000000000 --- a/testing/btest/doc/broxygen/all_scripts.test +++ /dev/null @@ -1,14 +0,0 @@ -# This test is mostly just checking that there's no errors that result -# from loading all scripts and generated docs for each. - -# This must be serialized with communication tests because it does load -# listen.bro in order to document it. - -# @TEST-PORT: BROKER_PORT -# @TEST-EXEC: unset BRO_DISABLE_BROXYGEN; bro -X broxygen.config broxygen DumpEvents::include=/NOTHING_MATCHES/ Broker::default_port=$BROKER_PORT -# @TEST-EXEC: btest-diff .stdout -# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr - -@TEST-START-FILE broxygen.config -script * scripts/ -@TEST-END-FILE diff --git a/testing/btest/language/addr.zeek b/testing/btest/language/addr.zeek index dd7e5e1dff..dff376ec4a 100644 --- a/testing/btest/language/addr.zeek +++ b/testing/btest/language/addr.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { # IPv4 addresses local a1: addr = 0.0.0.0; diff --git a/testing/btest/language/any.zeek b/testing/btest/language/any.zeek index fca23f6db8..32daa36903 100644 --- a/testing/btest/language/any.zeek +++ b/testing/btest/language/any.zeek @@ -11,7 +11,7 @@ function anyarg(arg1: any, arg1type: string) test_case( arg1type, type_name(arg1) == arg1type ); } -event bro_init() +event zeek_init() { local any1: any = 5; local any2: any = "bar"; diff --git a/testing/btest/language/at-if-event.zeek b/testing/btest/language/at-if-event.zeek index 0dd9815908..2ac757810d 100644 --- a/testing/btest/language/at-if-event.zeek +++ b/testing/btest/language/at-if-event.zeek @@ -12,7 +12,7 @@ lalala } @if ( 1==1 ) -event bro_init() +event zeek_init() @else lalala @endif @@ -24,7 +24,7 @@ lalala @if ( 1==0 ) lalala @else -event bro_init() +event zeek_init() @endif { print "3"; @@ -32,7 +32,7 @@ event bro_init() @if ( 1==1 ) @if ( 1==1 ) -event bro_init() +event zeek_init() @endif @else lalala @@ -42,7 +42,7 @@ lalala } @if ( 1==1 ) -event bro_init() &priority=10 +event zeek_init() &priority=10 @else lalala @endif diff --git a/testing/btest/language/at-if-invalid.zeek b/testing/btest/language/at-if-invalid.zeek index 1be2b94304..e2e5e2c699 100644 --- a/testing/btest/language/at-if-invalid.zeek +++ b/testing/btest/language/at-if-invalid.zeek @@ -6,7 +6,7 @@ function foo(c: count): bool global TRUE_CONDITION = T; -event bro_init() +event zeek_init() { local xyz = 0; local local_true_condition = T; diff --git a/testing/btest/language/at-if.zeek b/testing/btest/language/at-if.zeek index dddf9a22a5..1aba7b9ded 100644 --- a/testing/btest/language/at-if.zeek +++ b/testing/btest/language/at-if.zeek @@ -11,7 +11,7 @@ function foo(c: count): bool global TRUE_CONDITION = T; -event bro_init() +event zeek_init() { local xyz = 0; diff --git a/testing/btest/language/at-ifdef.zeek b/testing/btest/language/at-ifdef.zeek index e7bb961833..ebc59f7056 100644 --- a/testing/btest/language/at-ifdef.zeek +++ b/testing/btest/language/at-ifdef.zeek @@ -8,7 +8,7 @@ function test_case(msg: string, expect: bool) global thisisdefined = 123; -event bro_init() +event zeek_init() { local xyz = 0; diff --git a/testing/btest/language/at-ifndef.zeek b/testing/btest/language/at-ifndef.zeek index 8bff0c456b..6e4df4dd86 100644 --- a/testing/btest/language/at-ifndef.zeek +++ b/testing/btest/language/at-ifndef.zeek @@ -8,7 +8,7 @@ function test_case(msg: string, expect: bool) global thisisdefined = 123; -event bro_init() +event zeek_init() { local xyz = 0; diff --git a/testing/btest/language/at-load.zeek b/testing/btest/language/at-load.zeek index 7427cd639a..ae14eba436 100644 --- a/testing/btest/language/at-load.zeek +++ b/testing/btest/language/at-load.zeek @@ -5,7 +5,7 @@ @load secondtestfile -event bro_init() +event zeek_init() { test_case( "function", T ); test_case( "global variable", num == 123 ); diff --git a/testing/btest/language/attr-default-coercion.zeek b/testing/btest/language/attr-default-coercion.zeek index 14590d0033..8304169cfb 100644 --- a/testing/btest/language/attr-default-coercion.zeek +++ b/testing/btest/language/attr-default-coercion.zeek @@ -16,7 +16,7 @@ function foo(i: int &default = 237, d: double &default = 101) print i, d; } -event bro_init() +event zeek_init() { print t["nope"]; print r; diff --git a/testing/btest/language/bool.zeek b/testing/btest/language/bool.zeek index 8a1404459c..be54a442d9 100644 --- a/testing/btest/language/bool.zeek +++ b/testing/btest/language/bool.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local b1: bool = T; local b2: bool = F; diff --git a/testing/btest/language/common-mistakes.zeek b/testing/btest/language/common-mistakes.zeek index de7d02da23..4e9e017fda 100644 --- a/testing/btest/language/common-mistakes.zeek +++ b/testing/btest/language/common-mistakes.zeek @@ -33,17 +33,17 @@ function bar() print "bar done"; } -event bro_init() +event zeek_init() { bar(); # Unreachable - print "bro_init done"; + print "zeek_init done"; } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { # Reachable - print "other bro_init"; + print "other zeek_init"; } @TEST-END-FILE @@ -65,11 +65,11 @@ function foo() print "foo done"; } -event bro_init() +event zeek_init() { foo(); # Unreachable - print "bro_init done"; + print "zeek_init done"; } @TEST-END-FILE @@ -84,12 +84,12 @@ function foo(v: vector of any) print "foo done"; } -event bro_init() +event zeek_init() { local v: vector of count; v += 1; foo(v); # Unreachable - print "bro_init done", v; + print "zeek_init done", v; } @TEST-END-FILE diff --git a/testing/btest/language/conditional-expression.zeek b/testing/btest/language/conditional-expression.zeek index ea0acf009f..4938b87b4d 100644 --- a/testing/btest/language/conditional-expression.zeek +++ b/testing/btest/language/conditional-expression.zeek @@ -21,7 +21,7 @@ function f2(): bool } -event bro_init() +event zeek_init() { local a: count; local b: count; diff --git a/testing/btest/language/const.zeek b/testing/btest/language/const.zeek index 1c70d4d04b..6d7b3fe527 100644 --- a/testing/btest/language/const.zeek +++ b/testing/btest/language/const.zeek @@ -21,7 +21,7 @@ redef foo = 10; const bar = 9; -event bro_init() +event zeek_init() { const baz = 7; local i = foo; @@ -48,7 +48,7 @@ redef foo = 10; const bar = 9; -event bro_init() +event zeek_init() { const baz = 7; local s = 0; diff --git a/testing/btest/language/copy.zeek b/testing/btest/language/copy.zeek index 3ddbc15e23..e3d6b80d5b 100644 --- a/testing/btest/language/copy.zeek +++ b/testing/btest/language/copy.zeek @@ -8,7 +8,7 @@ function test_case(msg: string, expect: bool) -event bro_init() +event zeek_init() { # "b" is not a copy of "a" local a: set[string] = set("this", "test"); diff --git a/testing/btest/language/count.zeek b/testing/btest/language/count.zeek index 39a3786dfb..6e5dca8bc2 100644 --- a/testing/btest/language/count.zeek +++ b/testing/btest/language/count.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local c1: count = 0; local c2: count = 5; diff --git a/testing/btest/language/deprecated.zeek b/testing/btest/language/deprecated.zeek index ec9c3c9e1e..9ac6996145 100644 --- a/testing/btest/language/deprecated.zeek +++ b/testing/btest/language/deprecated.zeek @@ -24,7 +24,7 @@ type my_other_enum: enum { TWO = 2 &deprecated }; -event bro_init() +event zeek_init() { print ZERO; print ONE; diff --git a/testing/btest/language/double.zeek b/testing/btest/language/double.zeek index f85b216828..f1338ca16d 100644 --- a/testing/btest/language/double.zeek +++ b/testing/btest/language/double.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local d1: double = 3; local d2: double = +3; diff --git a/testing/btest/language/enum.zeek b/testing/btest/language/enum.zeek index 6de7d345da..c4aa2d71a1 100644 --- a/testing/btest/language/enum.zeek +++ b/testing/btest/language/enum.zeek @@ -14,7 +14,7 @@ type color: enum { Red, White, Blue, }; type city: enum { Rome, Paris }; -event bro_init() +event zeek_init() { local e1: color = Blue; local e2: color = White; diff --git a/testing/btest/language/eof-parse-errors.zeek b/testing/btest/language/eof-parse-errors.zeek index 58d8eeacc4..3b6ba8faf5 100644 --- a/testing/btest/language/eof-parse-errors.zeek +++ b/testing/btest/language/eof-parse-errors.zeek @@ -6,7 +6,7 @@ @TEST-START-FILE a.zeek module A; -event bro_init() +event zeek_init() { print "a"; @TEST-END-FILE @@ -14,7 +14,7 @@ event bro_init() @TEST-START-FILE b.zeek module B; -event bro_init() +event zeek_init() { print "b"; } diff --git a/testing/btest/language/event-local-var.zeek b/testing/btest/language/event-local-var.zeek index d4dd9d19a5..337cd37bac 100644 --- a/testing/btest/language/event-local-var.zeek +++ b/testing/btest/language/event-local-var.zeek @@ -7,7 +7,7 @@ event e1(num: count) print fmt("event 1: %s", num); } -event bro_init() +event zeek_init() { # Test assigning a local event variable to an event local v: event(num: count); diff --git a/testing/btest/language/event.zeek b/testing/btest/language/event.zeek index d4eef24731..664bff49ef 100644 --- a/testing/btest/language/event.zeek +++ b/testing/btest/language/event.zeek @@ -32,14 +32,14 @@ event e3(test: string) global e5: event(num: count); -event bro_init() +event zeek_init() { # Test calling an event with "event" statement event e1(); # Test calling an event with "schedule" statement - schedule 1 sec { e2("in bro_init") }; - schedule 3 sec { e2("another in bro_init") }; + schedule 1 sec { e2("in zeek_init") }; + schedule 3 sec { e2("another in zeek_init") }; # Test calling an event that has two separate definitions event e3("foo"); diff --git a/testing/btest/language/expire-expr-error.zeek b/testing/btest/language/expire-expr-error.zeek index 7c9a3aa318..b2ac4d7c55 100644 --- a/testing/btest/language/expire-expr-error.zeek +++ b/testing/btest/language/expire-expr-error.zeek @@ -20,7 +20,7 @@ event do_it() } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { data[0] = "some data"; schedule 1sec { do_it() }; diff --git a/testing/btest/language/expire-func-undef.zeek b/testing/btest/language/expire-func-undef.zeek index eb864d2390..2da735a9be 100644 --- a/testing/btest/language/expire-func-undef.zeek +++ b/testing/btest/language/expire-func-undef.zeek @@ -29,7 +29,7 @@ event new_connection(c: connection) } -event bro_done() +event zeek_done() { for (o in distinct_peers) diff --git a/testing/btest/language/expire-redef.zeek b/testing/btest/language/expire-redef.zeek index 5cbb00f313..552e26cce0 100644 --- a/testing/btest/language/expire-redef.zeek +++ b/testing/btest/language/expire-redef.zeek @@ -30,7 +30,7 @@ function expired(tbl: table[int] of string, idx: int): interval return 0sec; } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { data[0] = "some data"; schedule 4sec { do_it() }; diff --git a/testing/btest/language/expire_func.test b/testing/btest/language/expire_func.test index 653a4d9a86..c66a901a4f 100644 --- a/testing/btest/language/expire_func.test +++ b/testing/btest/language/expire_func.test @@ -9,7 +9,7 @@ function inform_me(s: set[string], idx: string): interval global s: set[string] &create_expire=1secs &expire_func=inform_me; -event bro_init() +event zeek_init() { add s["i"]; add s["am"]; diff --git a/testing/btest/language/expire_func_mod.zeek b/testing/btest/language/expire_func_mod.zeek index 4790a9650e..8b14dad74c 100644 --- a/testing/btest/language/expire_func_mod.zeek +++ b/testing/btest/language/expire_func_mod.zeek @@ -33,7 +33,7 @@ function table_expire_func(t: table[string] of count, s: string): interval return 0 secs; } -event bro_init() +event zeek_init() { local s="ashish"; t[s] = 1 ; diff --git a/testing/btest/language/expire_subnet.test b/testing/btest/language/expire_subnet.test index 12d5e56b5a..f0bf388ad0 100644 --- a/testing/btest/language/expire_subnet.test +++ b/testing/btest/language/expire_subnet.test @@ -55,7 +55,7 @@ function execute_test() ### Events ### -event bro_init() +event zeek_init() { step = 0; diff --git a/testing/btest/language/file.zeek b/testing/btest/language/file.zeek index 47430b6813..80d10a4d1f 100644 --- a/testing/btest/language/file.zeek +++ b/testing/btest/language/file.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: btest-diff out2 -event bro_init() +event zeek_init() { local f1: file = open( "out1" ); print f1, 20; diff --git a/testing/btest/language/for.zeek b/testing/btest/language/for.zeek index 5f0c211597..acf9612927 100644 --- a/testing/btest/language/for.zeek +++ b/testing/btest/language/for.zeek @@ -8,7 +8,7 @@ function test_case(msg: string, expect: bool) -event bro_init() +event zeek_init() { local vv: vector of string = vector( "a", "b", "c" ); local ct: count = 0; diff --git a/testing/btest/language/func-assignment.zeek b/testing/btest/language/func-assignment.zeek index 576d7f3270..724eac38ae 100644 --- a/testing/btest/language/func-assignment.zeek +++ b/testing/btest/language/func-assignment.zeek @@ -16,7 +16,7 @@ type sample_function: record { f: function(str: string): string; }; -event bro_init() +event zeek_init() { local test_sf: sample_function; test_sf$s = "Brogrammers, like bowties, are cool."; diff --git a/testing/btest/language/function.zeek b/testing/btest/language/function.zeek index ab60c4fa62..db2ac675b0 100644 --- a/testing/btest/language/function.zeek +++ b/testing/btest/language/function.zeek @@ -45,7 +45,7 @@ function f7(test: string): bool return F; } -event bro_init() +event zeek_init() { f1(); f2(); diff --git a/testing/btest/language/hook.zeek b/testing/btest/language/hook.zeek index 3edfd9556c..c14e153577 100644 --- a/testing/btest/language/hook.zeek +++ b/testing/btest/language/hook.zeek @@ -91,7 +91,7 @@ function printMe(s: string): bool return T; } -event bro_init() +event zeek_init() { print hook myhook([$a=1156, $b="hello world"]); diff --git a/testing/btest/language/hook_calls.zeek b/testing/btest/language/hook_calls.zeek index 411e0018bb..d465510a34 100644 --- a/testing/btest/language/hook_calls.zeek +++ b/testing/btest/language/hook_calls.zeek @@ -33,7 +33,7 @@ global t: table[count] of hook(i: count) = { [0] = myhook, }; -event bro_init() +event zeek_init() { hook myhook(3); print hook myhook(3); @@ -66,7 +66,7 @@ hook myhook(i: count) if ( i == 0 ) break; } -event bro_init() +event zeek_init() { myhook(3); print myhook(3); diff --git a/testing/btest/language/if.zeek b/testing/btest/language/if.zeek index 785030a012..9f3be4dd1b 100644 --- a/testing/btest/language/if.zeek +++ b/testing/btest/language/if.zeek @@ -8,7 +8,7 @@ function test_case(msg: string, expect: bool) -event bro_init() +event zeek_init() { # Test "if" without "else" diff --git a/testing/btest/language/index-assignment-invalid.zeek b/testing/btest/language/index-assignment-invalid.zeek index 68458eb149..662b73ff91 100644 --- a/testing/btest/language/index-assignment-invalid.zeek +++ b/testing/btest/language/index-assignment-invalid.zeek @@ -27,7 +27,7 @@ function foo(s: string, c: count) bar(c + 42); } -event bro_init() +event zeek_init() { Queue::put(q, "hello"); Queue::put(q, "goodbye"); diff --git a/testing/btest/language/init-in-anon-function.zeek b/testing/btest/language/init-in-anon-function.zeek index 45f5f09f09..4da70dd2f4 100644 --- a/testing/btest/language/init-in-anon-function.zeek +++ b/testing/btest/language/init-in-anon-function.zeek @@ -3,7 +3,7 @@ module Foo; -event bro_init() { +event zeek_init() { Log::remove_default_filter(HTTP::LOG); diff --git a/testing/btest/language/int.zeek b/testing/btest/language/int.zeek index f511d82bbb..d4314c8367 100644 --- a/testing/btest/language/int.zeek +++ b/testing/btest/language/int.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local i1: int = 3; local i2: int = +3; diff --git a/testing/btest/language/interval.zeek b/testing/btest/language/interval.zeek index 0bb912c4d9..c8b975e637 100644 --- a/testing/btest/language/interval.zeek +++ b/testing/btest/language/interval.zeek @@ -12,7 +12,7 @@ function approx_equal(x: double, y: double): bool return |(x - y)/x| < 1e-6 ? T : F; } -event bro_init() +event zeek_init() { # Constants without space and no letter "s" diff --git a/testing/btest/language/invalid_index.zeek b/testing/btest/language/invalid_index.zeek index 23fdb50d06..399865ba23 100644 --- a/testing/btest/language/invalid_index.zeek +++ b/testing/btest/language/invalid_index.zeek @@ -4,19 +4,19 @@ global foo: vector of count = { 42 }; global foo2: table[count] of count = { [0] = 13 }; -event bro_init() +event zeek_init() { print "foo[0]", foo[0]; print "foo[1]", foo[1]; } -event bro_init() +event zeek_init() { print "foo2[0]", foo2[0]; print "foo2[1]", foo2[1]; } -event bro_done() +event zeek_done() { print "done"; } diff --git a/testing/btest/language/key-value-for.zeek b/testing/btest/language/key-value-for.zeek index 97591dcacf..396c1d0bab 100644 --- a/testing/btest/language/key-value-for.zeek +++ b/testing/btest/language/key-value-for.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { # Test single keys diff --git a/testing/btest/language/module.zeek b/testing/btest/language/module.zeek index 3278697a8d..7f2512741f 100644 --- a/testing/btest/language/module.zeek +++ b/testing/btest/language/module.zeek @@ -30,7 +30,7 @@ event testevent(msg: string) # In this source file, we try to access each exported object from the module -event bro_init() +event zeek_init() { thisisatest::test_case( "function", T ); thisisatest::test_case( "global variable", thisisatest::num == 123 ); diff --git a/testing/btest/language/named-table-ctors.zeek b/testing/btest/language/named-table-ctors.zeek index 1fad56e30f..45d0974832 100644 --- a/testing/btest/language/named-table-ctors.zeek +++ b/testing/btest/language/named-table-ctors.zeek @@ -17,7 +17,7 @@ global mytablecomp: FooTableComp = FooTableComp(["test", 1] = "test1", ["cool", 2] = "cool2"); global mytabley: FooTableY = FooTableY(["one"] = 1, ["two"] = 2, ["three"] = 3) &default=0; -event bro_init() +event zeek_init() { print mytable; print mytablerec; diff --git a/testing/btest/language/next-test.zeek b/testing/btest/language/next-test.zeek index d46ad187c4..83523dd59b 100644 --- a/testing/btest/language/next-test.zeek +++ b/testing/btest/language/next-test.zeek @@ -4,7 +4,7 @@ # This script tests "next" being called during the last iteration of a # for loop -event bro_done() +event zeek_done() { local number_set: set[count]; diff --git a/testing/btest/language/no-module.zeek b/testing/btest/language/no-module.zeek index fff55d3854..4d1372f10c 100644 --- a/testing/btest/language/no-module.zeek +++ b/testing/btest/language/no-module.zeek @@ -23,7 +23,7 @@ event testevent(msg: string) # In this script, we try to access each object defined in the other script -event bro_init() +event zeek_init() { test_case( "function", T ); test_case( "global variable", num == 123 ); diff --git a/testing/btest/language/null-statement.zeek b/testing/btest/language/null-statement.zeek index 20c70f4876..69861ce96e 100644 --- a/testing/btest/language/null-statement.zeek +++ b/testing/btest/language/null-statement.zeek @@ -7,7 +7,7 @@ function f1(test: string) ; # null statement in function } -event bro_init() +event zeek_init() { local s1: set[string] = set( "this", "test" ); diff --git a/testing/btest/language/outer_param_binding.zeek b/testing/btest/language/outer_param_binding.zeek index fb37fd4712..a197cb87fb 100644 --- a/testing/btest/language/outer_param_binding.zeek +++ b/testing/btest/language/outer_param_binding.zeek @@ -21,7 +21,7 @@ function bar(b: string, c: string) print f$x("2"); } -event bro_init() +event zeek_init() { bar("1", "20"); } diff --git a/testing/btest/language/pattern.zeek b/testing/btest/language/pattern.zeek index e427b70e80..ae9cb15bf7 100644 --- a/testing/btest/language/pattern.zeek +++ b/testing/btest/language/pattern.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local p1: pattern = /foo|bar/; local p2: pattern = /oob/; diff --git a/testing/btest/language/port.zeek b/testing/btest/language/port.zeek index a9c7fd33e7..81d7704c14 100644 --- a/testing/btest/language/port.zeek +++ b/testing/btest/language/port.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local p1: port = 1/icmp; local p2: port = 2/udp; diff --git a/testing/btest/language/precedence.zeek b/testing/btest/language/precedence.zeek index 27fc1e024a..9d74c67262 100644 --- a/testing/btest/language/precedence.zeek +++ b/testing/btest/language/precedence.zeek @@ -9,7 +9,7 @@ function test_case(msg: string, expect: bool) # This is an incomplete set of tests to demonstrate the order of precedence # of bro script operators -event bro_init() +event zeek_init() { local n1: int; local n2: int; diff --git a/testing/btest/language/raw_output_attr.test b/testing/btest/language/raw_output_attr.test index 8bcd479fbf..3af94dc727 100644 --- a/testing/btest/language/raw_output_attr.test +++ b/testing/btest/language/raw_output_attr.test @@ -8,7 +8,7 @@ # first check local variable of file type w/ &raw_output -event bro_init() +event zeek_init() { local myfile: file; myfile = open("myfile"); diff --git a/testing/btest/language/record-ceorce-orphan.zeek b/testing/btest/language/record-ceorce-orphan.zeek index 126b99d5ff..d72f447a12 100644 --- a/testing/btest/language/record-ceorce-orphan.zeek +++ b/testing/btest/language/record-ceorce-orphan.zeek @@ -12,7 +12,7 @@ function myfunc(rec: myrec) print rec; } -event bro_init() +event zeek_init() { # Orhpaned fields in a record coercion reflect a programming error, like a typo, so should # be reported at parse-time to prevent unexpected run-time behavior. diff --git a/testing/btest/language/record-coerce-clash.zeek b/testing/btest/language/record-coerce-clash.zeek index a0bd6f21ad..5dab9ded8a 100644 --- a/testing/btest/language/record-coerce-clash.zeek +++ b/testing/btest/language/record-coerce-clash.zeek @@ -7,7 +7,7 @@ type myrec: record { cid: conn_id; }; -event bro_init() +event zeek_init() { local mr: myrec; mr = [$cid = [$orig_h=1.2.3.4,$orig_p=0/tcp,$resp_h=0.0.0.0,$resp_p=wrong]]; diff --git a/testing/btest/language/record-function-recursion.zeek b/testing/btest/language/record-function-recursion.zeek index 90832bfa69..d6a1587962 100644 --- a/testing/btest/language/record-function-recursion.zeek +++ b/testing/btest/language/record-function-recursion.zeek @@ -13,7 +13,7 @@ redef record Outer += { inner: Inner &optional; }; -event bro_init() { +event zeek_init() { local o = Outer(); print o; print type_name(o); diff --git a/testing/btest/language/record-recursive-coercion.zeek b/testing/btest/language/record-recursive-coercion.zeek index 0eb24a70d9..4d17c0dee3 100644 --- a/testing/btest/language/record-recursive-coercion.zeek +++ b/testing/btest/language/record-recursive-coercion.zeek @@ -32,7 +32,7 @@ function foo_func(fc: FooContainer) print fc; } -event bro_init() +event zeek_init() { for ( sw in matched_software ) print matched_software[sw]$version; diff --git a/testing/btest/language/record-type-checking.zeek b/testing/btest/language/record-type-checking.zeek index d58937d577..5e50a4d8bc 100644 --- a/testing/btest/language/record-type-checking.zeek +++ b/testing/btest/language/record-type-checking.zeek @@ -13,7 +13,7 @@ global gren: MyRec = MyRec($a = 1); # type clash in init # global, type deduction, anon ctor global grda = [$a = 2]; # fine -event bro_init() +event zeek_init() { grda = MyRec($a = 2); # type clash in assignment } @@ -22,26 +22,26 @@ event bro_init() global grea: MyRec = [$a = 3]; # type clash # local, type deduction, named ctor -event bro_init() +event zeek_init() { local lrdn = MyRec($a = 1000); # type clash } # local, type explicit, named ctor -event bro_init() +event zeek_init() { local lren: MyRec = MyRec($a = 1001); # type clash } # local, type deduction, anon ctor -event bro_init() +event zeek_init() { local lrda = [$a = 1002]; # fine lrda = MyRec($a = 1002); # type clash } # local, type explicit, anon ctor -event bro_init() +event zeek_init() { local lrea: MyRec = [$a = 1003]; # type clash } diff --git a/testing/btest/language/redef-same-prefixtable-idx.zeek b/testing/btest/language/redef-same-prefixtable-idx.zeek index 13cf27cc0f..e0e16060f4 100644 --- a/testing/btest/language/redef-same-prefixtable-idx.zeek +++ b/testing/btest/language/redef-same-prefixtable-idx.zeek @@ -10,7 +10,7 @@ redef my_table[3.0.0.0/8] = 2.0.0.0/8; # redef my_table += { [3.0.0.0/8] = 1.0.0.0/8 }; # redef my_table += { [3.0.0.0/8] = 2.0.0.0/8 }; -event bro_init() +event zeek_init() { print my_table; print my_table[3.0.0.0/8]; diff --git a/testing/btest/language/returnwhen.zeek b/testing/btest/language/returnwhen.zeek index 593841eb7e..c3d5f17661 100644 --- a/testing/btest/language/returnwhen.zeek +++ b/testing/btest/language/returnwhen.zeek @@ -58,7 +58,7 @@ event do_another() } } -event bro_init() +event zeek_init() { local local_dummy = dummyfunc; @@ -66,10 +66,10 @@ event bro_init() schedule 1sec { set_flag() }; - when ( local result = async_func("from bro_init()") ) + when ( local result = async_func("from zeek_init()") ) { - print "async_func() return result in bro_init()", result; - print local_dummy("from bro_init() when block"); + print "async_func() return result in zeek_init()", result; + print local_dummy("from zeek_init() when block"); print anon("hi"); if ( result == "timeout" ) terminate(); schedule 10msec { do_another() }; diff --git a/testing/btest/language/set-opt-record-index.zeek b/testing/btest/language/set-opt-record-index.zeek index d42de8b041..f22c144595 100644 --- a/testing/btest/language/set-opt-record-index.zeek +++ b/testing/btest/language/set-opt-record-index.zeek @@ -8,7 +8,7 @@ type FOO: record { b: count &optional; }; -event bro_init() +event zeek_init() { local set_of_foo: set[FOO] = set(); diff --git a/testing/btest/language/set-type-checking.zeek b/testing/btest/language/set-type-checking.zeek index 3c82a29730..3518b8a02d 100644 --- a/testing/btest/language/set-type-checking.zeek +++ b/testing/btest/language/set-type-checking.zeek @@ -11,7 +11,7 @@ global gen: MySet = MySet(1); # type clash in init # global, type deduction, anon ctor global gda = set(2); # fine -event bro_init() +event zeek_init() { gda = MySet(2); # type clash in assignment } @@ -20,26 +20,26 @@ event bro_init() global gea: MySet = set(3); # type clash # local, type deduction, named ctor -event bro_init() +event zeek_init() { local ldn = MySet(1000); # type clash } # local, type explicit, named ctor -event bro_init() +event zeek_init() { local len: MySet = MySet(1001); # type clash } # local, type deduction, anon ctor -event bro_init() +event zeek_init() { local lda = set(1002); # fine lda = MySet(1002); # type clash } # local, type explicit, anon ctor -event bro_init() +event zeek_init() { local lea: MySet = set(1003); # type clash } @@ -53,7 +53,7 @@ type MyRecord: record { global set_of_records: set[MyRecord]; -event bro_init() +event zeek_init() { # Set ctor w/ anonymous record ctor should coerce. set_of_records = set([$user="testuser", $host="testhost", $path="testpath"]); diff --git a/testing/btest/language/set.zeek b/testing/btest/language/set.zeek index 56cd649b49..53cf400795 100644 --- a/testing/btest/language/set.zeek +++ b/testing/btest/language/set.zeek @@ -13,7 +13,7 @@ global sg2: set[port, string, bool] = { [10/udp, "curly", F], [11/udp, "braces", T] }; global sg3 = { "more", "curly", "braces" }; -event bro_init() +event zeek_init() { local s1: set[string] = set( "test", "example" ); local s2: set[string] = set(); diff --git a/testing/btest/language/short-circuit.zeek b/testing/btest/language/short-circuit.zeek index 598ac8da35..70928f6441 100644 --- a/testing/btest/language/short-circuit.zeek +++ b/testing/btest/language/short-circuit.zeek @@ -21,7 +21,7 @@ function f_func(): bool } -event bro_init() +event zeek_init() { local res: bool; diff --git a/testing/btest/language/string.zeek b/testing/btest/language/string.zeek index abaa556b26..936ac3e493 100644 --- a/testing/btest/language/string.zeek +++ b/testing/btest/language/string.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local s1: string = "a\ty"; # tab local s2: string = "a\nb"; # newline diff --git a/testing/btest/language/strings.zeek b/testing/btest/language/strings.zeek index f601797978..992fb2c5b3 100644 --- a/testing/btest/language/strings.zeek +++ b/testing/btest/language/strings.zeek @@ -4,7 +4,7 @@ # Demo policy for string functions # -event bro_init() +event zeek_init() { local s1: string = "broisaveryneatids"; diff --git a/testing/btest/language/subnet-errors.zeek b/testing/btest/language/subnet-errors.zeek index fa98dcec48..499a6fb552 100644 --- a/testing/btest/language/subnet-errors.zeek +++ b/testing/btest/language/subnet-errors.zeek @@ -1,7 +1,7 @@ # @TEST-EXEC: bro -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out -event bro_init() +event zeek_init() { local i = 32; print 1.2.3.4/i; @@ -10,7 +10,7 @@ event bro_init() print "init 1"; } -event bro_init() +event zeek_init() { local i = 128; print [::]/i; @@ -19,7 +19,7 @@ event bro_init() print "init 1"; } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { print "init last"; } diff --git a/testing/btest/language/subnet.zeek b/testing/btest/language/subnet.zeek index b3b50e085f..32cf11701e 100644 --- a/testing/btest/language/subnet.zeek +++ b/testing/btest/language/subnet.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { # IPv4 addr local a1: addr = 192.1.2.3; diff --git a/testing/btest/language/switch-incomplete.zeek b/testing/btest/language/switch-incomplete.zeek index 7ee800b274..dedf529ccb 100644 --- a/testing/btest/language/switch-incomplete.zeek +++ b/testing/btest/language/switch-incomplete.zeek @@ -1,7 +1,7 @@ # @TEST-EXEC-FAIL: bro -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out -event bro_init() +event zeek_init() { switch ( 1 ) { case 1: diff --git a/testing/btest/language/switch-statement.zeek b/testing/btest/language/switch-statement.zeek index 152b14f87d..1035cb4b2e 100644 --- a/testing/btest/language/switch-statement.zeek +++ b/testing/btest/language/switch-statement.zeek @@ -219,7 +219,7 @@ function test_switch(actual: string, expect: string) print fmt("%s != %s", actual, expect); } -event bro_init() +event zeek_init() { test_switch( switch_bool(T) , "true" ); test_switch( switch_bool(F) , "false" ); diff --git a/testing/btest/language/switch-types-vars.zeek b/testing/btest/language/switch-types-vars.zeek index 1b0ca5591b..3e33e1c17f 100644 --- a/testing/btest/language/switch-types-vars.zeek +++ b/testing/btest/language/switch-types-vars.zeek @@ -36,7 +36,7 @@ function switch_one(v: any) } } -event bro_init() +event zeek_init() { switch_one("My StrIng"); switch_one(42); diff --git a/testing/btest/language/switch-types.zeek b/testing/btest/language/switch-types.zeek index 468ba93922..2ebddea6f0 100644 --- a/testing/btest/language/switch-types.zeek +++ b/testing/btest/language/switch-types.zeek @@ -30,7 +30,7 @@ function switch_one_no_default(v: any): string } -event bro_init() +event zeek_init() { print switch_one("string"); print switch_one(42); diff --git a/testing/btest/language/table-init-attrs.zeek b/testing/btest/language/table-init-attrs.zeek index 76d98b9fed..9d3403642a 100644 --- a/testing/btest/language/table-init-attrs.zeek +++ b/testing/btest/language/table-init-attrs.zeek @@ -51,7 +51,7 @@ global inception_table2: table[count] of table[count] of string = { [0] = table([13] = "bar") &default="forty-two", } &default=table() &default="we need to go deeper"; -event bro_init() +event zeek_init() { print "my_set_ctor_init"; print my_set_ctor_init; diff --git a/testing/btest/language/table-init.zeek b/testing/btest/language/table-init.zeek index 7419a50879..cc94589974 100644 --- a/testing/btest/language/table-init.zeek +++ b/testing/btest/language/table-init.zeek @@ -6,7 +6,7 @@ global global_table: table[count] of string = { [2] = "two" } &default = "global table default"; -event bro_init() +event zeek_init() { local local_table: table[count] of string = { [3] = "three", diff --git a/testing/btest/language/table-type-checking.zeek b/testing/btest/language/table-type-checking.zeek index f579a83d37..639a2d021d 100644 --- a/testing/btest/language/table-type-checking.zeek +++ b/testing/btest/language/table-type-checking.zeek @@ -12,7 +12,7 @@ global gen: MyTable = MyTable(["one"] = 1); # type clash in init # global, type deduction, anon ctor global gda = table(["two"] = 2); # fine global gda2 = MyTable([2/tcp] = 2); # fine -event bro_init() +event zeek_init() { gda = gda2; # type clash } @@ -21,26 +21,26 @@ event bro_init() global gea: MyTable = table(["three"] = 3); # type clash # local, type deduction, named ctor -event bro_init() +event zeek_init() { local ldn = MyTable(["thousand"] = 1000); # type clash } # local, type explicit, named ctor -event bro_init() +event zeek_init() { local len: MyTable = MyTable(["thousand-one"] = 1001); # type clash } # local, type deduction, anon ctor -event bro_init() +event zeek_init() { local lda = table(["thousand-two"] = 1002); # fine lda = MyTable(["thousand-two"] = 1002); # type clash } # local, type explicit, anon ctor -event bro_init() +event zeek_init() { local lea: MyTable = table(["thousand-three"] = 1003); # type clash } diff --git a/testing/btest/language/table.zeek b/testing/btest/language/table.zeek index 3c8e8db280..98f7daa8e3 100644 --- a/testing/btest/language/table.zeek +++ b/testing/btest/language/table.zeek @@ -10,7 +10,7 @@ function test_case(msg: string, expect: bool) # type is not explicitly specified global tg1 = { [1] = "type", [2] = "inference", [3] = "test" }; -event bro_init() +event zeek_init() { local t1: table[count] of string = table( [5] = "test", [0] = "example" ); local t2: table[count] of string = table(); diff --git a/testing/btest/language/ternary-record-mismatch.zeek b/testing/btest/language/ternary-record-mismatch.zeek index 068952a69f..3c0c4ab95e 100644 --- a/testing/btest/language/ternary-record-mismatch.zeek +++ b/testing/btest/language/ternary-record-mismatch.zeek @@ -7,7 +7,7 @@ type MyRecord: record { c: bool &default = T; }; -event bro_init() +event zeek_init() { local rec: MyRecord = record($a = "a string", $b = 6); local rec2: MyRecord = (F) ? MyRecord($a = "a string", $b = 6) : diff --git a/testing/btest/language/time.zeek b/testing/btest/language/time.zeek index dd4b6336fe..e8b71219ca 100644 --- a/testing/btest/language/time.zeek +++ b/testing/btest/language/time.zeek @@ -7,7 +7,7 @@ function test_case(msg: string, expect: bool) } -event bro_init() +event zeek_init() { local t1: time = current_time(); local t2: time = t1 + 3 sec; diff --git a/testing/btest/language/timeout.zeek b/testing/btest/language/timeout.zeek index 632ab18b5f..47906b35fb 100644 --- a/testing/btest/language/timeout.zeek +++ b/testing/btest/language/timeout.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: btest-diff out -event bro_init() +event zeek_init() { local h1: addr = 1.2.3.4; diff --git a/testing/btest/language/type-cast-any.zeek b/testing/btest/language/type-cast-any.zeek index ddd4ea2dbe..ad18a28646 100644 --- a/testing/btest/language/type-cast-any.zeek +++ b/testing/btest/language/type-cast-any.zeek @@ -27,7 +27,7 @@ function cast_to_X(a: any, b: X) print a, P, P is X, fmt("%s==%s => %s", b, P, Cmp); } -event bro_init() +event zeek_init() { local x: X; x = [$a = 1.2.3.4, $b=1947/tcp]; diff --git a/testing/btest/language/type-cast-error-dynamic.zeek b/testing/btest/language/type-cast-error-dynamic.zeek index c18548b0c4..21f51bc8d8 100644 --- a/testing/btest/language/type-cast-error-dynamic.zeek +++ b/testing/btest/language/type-cast-error-dynamic.zeek @@ -11,19 +11,19 @@ function cast_to_string(a: any) print a as string; } -event bro_init() +event zeek_init() { cast_to_string(42); } -event bro_init() +event zeek_init() { local x: X; x = [$a = 1.2.3.4, $b=1947/tcp]; cast_to_string(x); } -event bro_init() +event zeek_init() { print "data is string", Broker::Data() is string; cast_to_string(Broker::Data()); diff --git a/testing/btest/language/type-cast-error-static.zeek b/testing/btest/language/type-cast-error-static.zeek index 3533fef3cb..3d1afbe095 100644 --- a/testing/btest/language/type-cast-error-static.zeek +++ b/testing/btest/language/type-cast-error-static.zeek @@ -6,7 +6,7 @@ type X: record { b: port; }; -event bro_init() +event zeek_init() { local x: X; x = [$a = 1.2.3.4, $b=1947/tcp]; diff --git a/testing/btest/language/type-cast-same.zeek b/testing/btest/language/type-cast-same.zeek index 93c3b633fa..58e98bb0c0 100644 --- a/testing/btest/language/type-cast-same.zeek +++ b/testing/btest/language/type-cast-same.zeek @@ -6,7 +6,7 @@ type X: record { b: port; }; -event bro_init() +event zeek_init() { local x: X; x = [$a = 1.2.3.4, $b=1947/tcp]; diff --git a/testing/btest/language/type-check-any.zeek b/testing/btest/language/type-check-any.zeek index 5d882c8997..1b681a3420 100644 --- a/testing/btest/language/type-check-any.zeek +++ b/testing/btest/language/type-check-any.zeek @@ -11,7 +11,7 @@ function check(a: any) print a, a is string, a is count, a is X; } -event bro_init() +event zeek_init() { local x: X; x = [$a = 1.2.3.4, $b=1947/tcp]; diff --git a/testing/btest/language/type-check-vector.zeek b/testing/btest/language/type-check-vector.zeek index 461fb312fb..b92c654fb6 100644 --- a/testing/btest/language/type-check-vector.zeek +++ b/testing/btest/language/type-check-vector.zeek @@ -9,7 +9,7 @@ function check(a: any) print a as myvec; } -event bro_init() +event zeek_init() { local v = myvec("one", "two", 3); check(v); diff --git a/testing/btest/language/type-type-error.zeek b/testing/btest/language/type-type-error.zeek index 047e4b34ef..2f3e3913ef 100644 --- a/testing/btest/language/type-type-error.zeek +++ b/testing/btest/language/type-type-error.zeek @@ -5,7 +5,7 @@ type r: record { a: string; }; -event bro_init() +event zeek_init() { # This should generate a parse error indicating that the type identifier # is incorrectly used in an expression expecting a real value and not diff --git a/testing/btest/language/undefined-delete-field.zeek b/testing/btest/language/undefined-delete-field.zeek index 8271f016fe..a45e093527 100644 --- a/testing/btest/language/undefined-delete-field.zeek +++ b/testing/btest/language/undefined-delete-field.zeek @@ -7,7 +7,7 @@ type MyRecordType: record b: count; }; -event bro_init() +event zeek_init() { local x = MyRecordType($a=1, $b=2); diff --git a/testing/btest/language/uninitialized-local.zeek b/testing/btest/language/uninitialized-local.zeek index ae486ebf1f..ec4a6e61de 100644 --- a/testing/btest/language/uninitialized-local.zeek +++ b/testing/btest/language/uninitialized-local.zeek @@ -16,7 +16,7 @@ event testit() my_vector[0] = my_string; } -event bro_init() +event zeek_init() { event testit(); } diff --git a/testing/btest/language/uninitialized-local2.zeek b/testing/btest/language/uninitialized-local2.zeek index f11a5fda10..ed4045a1a3 100644 --- a/testing/btest/language/uninitialized-local2.zeek +++ b/testing/btest/language/uninitialized-local2.zeek @@ -19,7 +19,7 @@ event test() print "var_b is", var_b; } -event bro_init() +event zeek_init() { event test(); } diff --git a/testing/btest/language/vector-any-append.zeek b/testing/btest/language/vector-any-append.zeek index 816627fbf1..d501af6b15 100644 --- a/testing/btest/language/vector-any-append.zeek +++ b/testing/btest/language/vector-any-append.zeek @@ -11,7 +11,7 @@ function append(v: vector of any) v += |v|; } -event bro_init() +event zeek_init() { local v: vector of count; assign(v); diff --git a/testing/btest/language/vector-type-checking.zeek b/testing/btest/language/vector-type-checking.zeek index b4c75118d1..c0003503a4 100644 --- a/testing/btest/language/vector-type-checking.zeek +++ b/testing/btest/language/vector-type-checking.zeek @@ -12,7 +12,7 @@ global gen: MyVec = MyVec("one"); # type clash in init # global, type deduction, anon ctor global gda = vector("two"); # fine global gda2 = MyVec(2); # fine -event bro_init() +event zeek_init() { gda = gda2; # type clash } @@ -21,26 +21,26 @@ event bro_init() global gea: MyVec = vector("three"); # type clash # local, type deduction, named ctor -event bro_init() +event zeek_init() { local ldn = MyVec("thousand"); # type clash } # local, type explicit, named ctor -event bro_init() +event zeek_init() { local len: MyVec = MyVec("thousand-one"); # type clash } # local, type deduction, anon ctor -event bro_init() +event zeek_init() { local lda = vector("thousand-two"); # fine lda = MyVec("thousand-two"); # type clash } # local, type explicit, anon ctor -event bro_init() +event zeek_init() { local lea: MyVec = vector("thousand-three"); # type clash } diff --git a/testing/btest/language/vector.zeek b/testing/btest/language/vector.zeek index 0eafd6c60c..36ff7c0267 100644 --- a/testing/btest/language/vector.zeek +++ b/testing/btest/language/vector.zeek @@ -10,7 +10,7 @@ function test_case(msg: string, expect: bool) # Note: only global vectors can be initialized with curly braces global vg1: vector of string = { "curly", "braces" }; -event bro_init() +event zeek_init() { local v1: vector of string = vector( "test", "example" ); local v2: vector of string = vector(); diff --git a/testing/btest/language/when-unitialized-rhs.zeek b/testing/btest/language/when-unitialized-rhs.zeek index 21b94c6e02..196834c2ae 100644 --- a/testing/btest/language/when-unitialized-rhs.zeek +++ b/testing/btest/language/when-unitialized-rhs.zeek @@ -4,7 +4,7 @@ global crashMe: function(): string; global x: int; -event bro_init() +event zeek_init() { when( local result = crashMe() ) { diff --git a/testing/btest/language/when.zeek b/testing/btest/language/when.zeek index a2bad6a620..36914ce993 100644 --- a/testing/btest/language/when.zeek +++ b/testing/btest/language/when.zeek @@ -5,7 +5,7 @@ redef exit_only_after_terminate = T; -event bro_init() +event zeek_init() { local h: addr = 127.0.0.1; diff --git a/testing/btest/language/while.zeek b/testing/btest/language/while.zeek index 6828b00b41..d6588589f7 100644 --- a/testing/btest/language/while.zeek +++ b/testing/btest/language/while.zeek @@ -67,7 +67,7 @@ function test_return(): vector of string return rval; } -event bro_init() +event zeek_init() { test_noop(); test_it(); diff --git a/testing/btest/language/zeek_init.bro b/testing/btest/language/zeek_init.bro new file mode 100644 index 0000000000..27f82d626c --- /dev/null +++ b/testing/btest/language/zeek_init.bro @@ -0,0 +1,44 @@ +# @TEST-EXEC: bro -b %INPUT >out +# @TEST-EXEC: btest-diff out + + +event zeek_init() &priority=10 + { + print "zeek_init at priority 10!"; + } + +event bro_init() &priority=5 + { + print "bro_init at priority 5!"; + } + +event zeek_init() &priority=0 + { + print "zeek_init at priority 0!"; + } + +event bro_init() &priority=-10 + { + print "bro_init at priority -10!"; + } + + +event zeek_done() &priority=10 + { + print "zeek_done at priority 10!"; + } + +event bro_done() &priority=5 + { + print "bro_done at priority 5!"; + } + +event zeek_done() &priority=0 + { + print "zeek_done at priority 0!"; + } + +event bro_done() &priority=-10 + { + print "bro_done at priority -10!"; + } diff --git a/testing/btest/plugins/bifs-and-scripts-install.sh b/testing/btest/plugins/bifs-and-scripts-install.sh index dac1eeb3c2..f3a60d20b7 100644 --- a/testing/btest/plugins/bifs-and-scripts-install.sh +++ b/testing/btest/plugins/bifs-and-scripts-install.sh @@ -18,7 +18,7 @@ cat >scripts/Demo/Foo/__load__.zeek <scripts/Demo/Foo/manually.zeek <scripts/Demo/Foo/base/at-startup.zeek <scripts/Demo/Foo/__load__.zeek <scripts/Demo/Foo/manually.zeek <scripts/Demo/Foo/base/at-startup.zeek <&1 # @TEST-EXEC: btest-diff .stdout -event bro_init() +event zeek_init() { print "This should fail but not crash"; print Files::lookup_file("asdf"); diff --git a/testing/btest/scripts/base/frameworks/file-analysis/bifs/register_mime_type.zeek b/testing/btest/scripts/base/frameworks/file-analysis/bifs/register_mime_type.zeek index 9b6d11ce0d..df4573e418 100644 --- a/testing/btest/scripts/base/frameworks/file-analysis/bifs/register_mime_type.zeek +++ b/testing/btest/scripts/base/frameworks/file-analysis/bifs/register_mime_type.zeek @@ -1,7 +1,7 @@ # @TEST-EXEC: bro -r $TRACES/http/get.trace %INPUT # @TEST-EXEC: btest-diff files.log -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_MD5, "text/plain"); }; diff --git a/testing/btest/scripts/base/frameworks/file-analysis/input/basic.zeek b/testing/btest/scripts/base/frameworks/file-analysis/input/basic.zeek index 27be2b943c..9bafa0ca1e 100644 --- a/testing/btest/scripts/base/frameworks/file-analysis/input/basic.zeek +++ b/testing/btest/scripts/base/frameworks/file-analysis/input/basic.zeek @@ -18,7 +18,7 @@ redef test_get_file_name = function(f: fa_file): string T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242 @TEST-END-FILE -event bro_init() +event zeek_init() { local source: string = "../input.log"; Input::add_analysis([$source=source, $reader=Input::READER_BINARY, diff --git a/testing/btest/scripts/base/frameworks/input/basic.zeek b/testing/btest/scripts/base/frameworks/input/basic.zeek index 356b87d70b..02c3b4ff79 100644 --- a/testing/btest/scripts/base/frameworks/input/basic.zeek +++ b/testing/btest/scripts/base/frameworks/input/basic.zeek @@ -47,7 +47,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/bignumber.zeek b/testing/btest/scripts/base/frameworks/input/bignumber.zeek index 15d711b1c4..b5b9d3fcae 100644 --- a/testing/btest/scripts/base/frameworks/input/bignumber.zeek +++ b/testing/btest/scripts/base/frameworks/input/bignumber.zeek @@ -26,7 +26,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/binary.zeek b/testing/btest/scripts/base/frameworks/input/binary.zeek index 11701fbd8a..072db53e11 100644 --- a/testing/btest/scripts/base/frameworks/input/binary.zeek +++ b/testing/btest/scripts/base/frameworks/input/binary.zeek @@ -45,7 +45,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, a: string, b } } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/config/basic.zeek b/testing/btest/scripts/base/frameworks/input/config/basic.zeek index c8d68fc822..a0a7df017f 100644 --- a/testing/btest/scripts/base/frameworks/input/config/basic.zeek +++ b/testing/btest/scripts/base/frameworks/input/config/basic.zeek @@ -67,7 +67,7 @@ event Input::end_of_data(name: string, source:string) terminate(); } -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_table([$reader=Input::READER_CONFIG, $source="../configfile", $name="configuration", $idx=Idx, $val=Val, $destination=currconfig, $want_record=F]); diff --git a/testing/btest/scripts/base/frameworks/input/config/errors.zeek b/testing/btest/scripts/base/frameworks/input/config/errors.zeek index 4f398956dc..262b4ff36d 100644 --- a/testing/btest/scripts/base/frameworks/input/config/errors.zeek +++ b/testing/btest/scripts/base/frameworks/input/config/errors.zeek @@ -58,7 +58,7 @@ event Input::end_of_data(name: string, source:string) terminate(); } -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_table([$reader=Input::READER_CONFIG, $source="../configfile", $name="configuration", $idx=Idx, $val=Val, $destination=currconfig, $want_record=F]); diff --git a/testing/btest/scripts/base/frameworks/input/config/spaces.zeek b/testing/btest/scripts/base/frameworks/input/config/spaces.zeek index 90afa20b13..00bc64888e 100644 --- a/testing/btest/scripts/base/frameworks/input/config/spaces.zeek +++ b/testing/btest/scripts/base/frameworks/input/config/spaces.zeek @@ -51,7 +51,7 @@ event Input::end_of_data(name: string, source:string) terminate(); } -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_table([$reader=Input::READER_CONFIG, $source="../configfile", $name="configuration", $idx=Idx, $val=Val, $destination=currconfig, $want_record=F]); diff --git a/testing/btest/scripts/base/frameworks/input/default.zeek b/testing/btest/scripts/base/frameworks/input/default.zeek index c5b0e2f967..3c9880696d 100644 --- a/testing/btest/scripts/base/frameworks/input/default.zeek +++ b/testing/btest/scripts/base/frameworks/input/default.zeek @@ -33,7 +33,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, val: Val) print outfile, val; } -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_event([$source="../input.log", $name="input", $fields=Val, $ev=line, $want_record=T]); diff --git a/testing/btest/scripts/base/frameworks/input/empty-values-hashing.zeek b/testing/btest/scripts/base/frameworks/input/empty-values-hashing.zeek index b46c299c2c..b43044b963 100644 --- a/testing/btest/scripts/base/frameworks/input/empty-values-hashing.zeek +++ b/testing/btest/scripts/base/frameworks/input/empty-values-hashing.zeek @@ -52,7 +52,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r print outfile, right; } -event bro_init() +event zeek_init() { outfile = open("../out"); try = 0; diff --git a/testing/btest/scripts/base/frameworks/input/emptyvals.zeek b/testing/btest/scripts/base/frameworks/input/emptyvals.zeek index 57e79dd977..6e45f56e8d 100644 --- a/testing/btest/scripts/base/frameworks/input/emptyvals.zeek +++ b/testing/btest/scripts/base/frameworks/input/emptyvals.zeek @@ -29,7 +29,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/errors.zeek b/testing/btest/scripts/base/frameworks/input/errors.zeek index 0d0376694a..296c43f450 100644 --- a/testing/btest/scripts/base/frameworks/input/errors.zeek +++ b/testing/btest/scripts/base/frameworks/input/errors.zeek @@ -148,7 +148,7 @@ event kill_me() terminate(); } -event bro_init() +event zeek_init() { outfile = open("out"); Input::add_event([$source="input.log", $name="file", $fields=FileVal, $ev=line_file, $want_record=T]); diff --git a/testing/btest/scripts/base/frameworks/input/event.zeek b/testing/btest/scripts/base/frameworks/input/event.zeek index 6b6a391939..1ac4e38af5 100644 --- a/testing/btest/scripts/base/frameworks/input/event.zeek +++ b/testing/btest/scripts/base/frameworks/input/event.zeek @@ -35,7 +35,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, i: int, b: b print outfile, b; } -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_event([$source="../input.log", $name="input", $fields=Val, $ev=line, $want_record=F]); diff --git a/testing/btest/scripts/base/frameworks/input/invalid-lines.zeek b/testing/btest/scripts/base/frameworks/input/invalid-lines.zeek index 83be1efd09..2a2e2b1e63 100644 --- a/testing/btest/scripts/base/frameworks/input/invalid-lines.zeek +++ b/testing/btest/scripts/base/frameworks/input/invalid-lines.zeek @@ -50,7 +50,7 @@ type Val: record { global servers: table[int] of Val = table(); global servers2: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/invalidnumbers.zeek b/testing/btest/scripts/base/frameworks/input/invalidnumbers.zeek index f2fefaa5d0..4acaa63ee6 100644 --- a/testing/btest/scripts/base/frameworks/input/invalidnumbers.zeek +++ b/testing/btest/scripts/base/frameworks/input/invalidnumbers.zeek @@ -30,7 +30,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/invalidset.zeek b/testing/btest/scripts/base/frameworks/input/invalidset.zeek index 932060424e..d1ca5e3262 100644 --- a/testing/btest/scripts/base/frameworks/input/invalidset.zeek +++ b/testing/btest/scripts/base/frameworks/input/invalidset.zeek @@ -45,7 +45,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, v: Val) print outfile, "Event", v; } -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/invalidtext.zeek b/testing/btest/scripts/base/frameworks/input/invalidtext.zeek index 3f5b590dec..3a30da30c8 100644 --- a/testing/btest/scripts/base/frameworks/input/invalidtext.zeek +++ b/testing/btest/scripts/base/frameworks/input/invalidtext.zeek @@ -46,7 +46,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, v: Val) print outfile, "Event", v; } -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/missing-enum.zeek b/testing/btest/scripts/base/frameworks/input/missing-enum.zeek index 0d37aae453..abdc608447 100644 --- a/testing/btest/scripts/base/frameworks/input/missing-enum.zeek +++ b/testing/btest/scripts/base/frameworks/input/missing-enum.zeek @@ -22,7 +22,7 @@ type Val: record { global etable: table[int] of Log::ID = table(); -event bro_init() +event zeek_init() { # first read in the old stuff into the table... Input::add_table([$source="../input.log", $name="enum", $idx=Idx, $val=Val, $destination=etable, $want_record=F]); diff --git a/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek b/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek index 7c9f51994c..0fed78d120 100644 --- a/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek +++ b/testing/btest/scripts/base/frameworks/input/missing-file-initially.zeek @@ -50,7 +50,7 @@ event line2(description: Input::EventDescription, tpe: Input::Event, v: Val) } -event bro_init() +event zeek_init() { Input::add_event([$source="../does-not-exist.dat", $name="input", $reader=Input::READER_ASCII, $mode=Input::REREAD, $fields=Val, $ev=line, $want_record=T]); Input::add_event([$source="../does-not-exist.dat", $name="inputstream", $reader=Input::READER_ASCII, $mode=Input::STREAM, $fields=Val, $ev=line, $want_record=T]); diff --git a/testing/btest/scripts/base/frameworks/input/missing-file.zeek b/testing/btest/scripts/base/frameworks/input/missing-file.zeek index 2ec3bb937f..90fbeb175e 100644 --- a/testing/btest/scripts/base/frameworks/input/missing-file.zeek +++ b/testing/btest/scripts/base/frameworks/input/missing-file.zeek @@ -19,7 +19,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, i: int, b: b { } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/onecolumn-norecord.zeek b/testing/btest/scripts/base/frameworks/input/onecolumn-norecord.zeek index c38c4efd85..723227a1c3 100644 --- a/testing/btest/scripts/base/frameworks/input/onecolumn-norecord.zeek +++ b/testing/btest/scripts/base/frameworks/input/onecolumn-norecord.zeek @@ -28,7 +28,7 @@ type Val: record { global servers: table[int] of bool = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers, $want_record=F]); diff --git a/testing/btest/scripts/base/frameworks/input/onecolumn-record.zeek b/testing/btest/scripts/base/frameworks/input/onecolumn-record.zeek index 3ee82983ff..33da194d84 100644 --- a/testing/btest/scripts/base/frameworks/input/onecolumn-record.zeek +++ b/testing/btest/scripts/base/frameworks/input/onecolumn-record.zeek @@ -28,7 +28,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_table([$name="input", $source="../input.log", $idx=Idx, $val=Val, $destination=servers]); diff --git a/testing/btest/scripts/base/frameworks/input/optional.zeek b/testing/btest/scripts/base/frameworks/input/optional.zeek index 56c261999d..9b9d569ffe 100644 --- a/testing/btest/scripts/base/frameworks/input/optional.zeek +++ b/testing/btest/scripts/base/frameworks/input/optional.zeek @@ -35,7 +35,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-prefix.zeek b/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-prefix.zeek index 68805679a9..784be4ca06 100644 --- a/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-prefix.zeek +++ b/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-prefix.zeek @@ -22,7 +22,7 @@ @load path-prefix-common-table.zeek redef InputAscii::path_prefix = "@path_prefix@"; -event bro_init() +event zeek_init() { Input::add_table([$source="input.data", $name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F]); @@ -35,7 +35,7 @@ event bro_init() @load path-prefix-common-event.zeek redef InputAscii::path_prefix = "@path_prefix@"; -event bro_init() +event zeek_init() { Input::add_event([$source="input.data", $name="input", $fields=Val, $ev=inputev]); @@ -48,7 +48,7 @@ event bro_init() @load path-prefix-common-analysis.zeek redef InputBinary::path_prefix = "@path_prefix@"; -event bro_init() +event zeek_init() { Input::add_analysis([$source="input.data", $name="input"]); } diff --git a/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-source.zeek b/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-source.zeek index 238150ffef..747c3d46dd 100644 --- a/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-source.zeek +++ b/testing/btest/scripts/base/frameworks/input/path-prefix/absolute-source.zeek @@ -16,7 +16,7 @@ @load path-prefix-common-table.zeek redef InputAscii::path_prefix = "/this/does/not/exist"; -event bro_init() +event zeek_init() { Input::add_table([$source="@path_prefix@/input.data", $name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F]); @@ -29,7 +29,7 @@ event bro_init() @load path-prefix-common-event.zeek redef InputAscii::path_prefix = "/this/does/not/exist"; -event bro_init() +event zeek_init() { Input::add_event([$source="@path_prefix@/input.data", $name="input", $fields=Val, $ev=inputev]); @@ -42,7 +42,7 @@ event bro_init() @load path-prefix-common-analysis.zeek redef InputBinary::path_prefix = "/this/does/not/exist"; -event bro_init() +event zeek_init() { Input::add_analysis([$source="@path_prefix@/input.data", $name="input"]); } diff --git a/testing/btest/scripts/base/frameworks/input/path-prefix/no-paths.zeek b/testing/btest/scripts/base/frameworks/input/path-prefix/no-paths.zeek index ed1cccbda8..02a6e7e104 100644 --- a/testing/btest/scripts/base/frameworks/input/path-prefix/no-paths.zeek +++ b/testing/btest/scripts/base/frameworks/input/path-prefix/no-paths.zeek @@ -13,7 +13,7 @@ @load path-prefix-common-table.zeek -event bro_init() +event zeek_init() { Input::add_table([$source="input.data", $name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F]); @@ -25,7 +25,7 @@ event bro_init() @load path-prefix-common-event.zeek -event bro_init() +event zeek_init() { Input::add_event([$source="input.data", $name="input", $fields=Val, $ev=inputev]); @@ -37,7 +37,7 @@ event bro_init() @load path-prefix-common-analysis.zeek -event bro_init() +event zeek_init() { Input::add_analysis([$source="input.data", $name="input"]); } diff --git a/testing/btest/scripts/base/frameworks/input/path-prefix/relative-prefix.zeek b/testing/btest/scripts/base/frameworks/input/path-prefix/relative-prefix.zeek index 8706ade3f5..2f24131b6f 100644 --- a/testing/btest/scripts/base/frameworks/input/path-prefix/relative-prefix.zeek +++ b/testing/btest/scripts/base/frameworks/input/path-prefix/relative-prefix.zeek @@ -16,7 +16,7 @@ @load path-prefix-common-table.zeek redef InputAscii::path_prefix = "alternative"; -event bro_init() +event zeek_init() { Input::add_table([$source="input.data", $name="input", $idx=Idx, $val=Val, $destination=destination, $want_record=F]); @@ -29,7 +29,7 @@ event bro_init() @load path-prefix-common-event.zeek redef InputAscii::path_prefix = "alternative"; -event bro_init() +event zeek_init() { Input::add_event([$source="input.data", $name="input", $fields=Val, $ev=inputev]); @@ -42,7 +42,7 @@ event bro_init() @load path-prefix-common-analysis.zeek redef InputBinary::path_prefix = "alternative"; -event bro_init() +event zeek_init() { Input::add_analysis([$source="input.data", $name="input"]); } diff --git a/testing/btest/scripts/base/frameworks/input/port-embedded.zeek b/testing/btest/scripts/base/frameworks/input/port-embedded.zeek index 8aab733069..32feb47c34 100644 --- a/testing/btest/scripts/base/frameworks/input/port-embedded.zeek +++ b/testing/btest/scripts/base/frameworks/input/port-embedded.zeek @@ -32,7 +32,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r print left, right; } -event bro_init() +event zeek_init() { Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $ev=line, $destination=servers]); } diff --git a/testing/btest/scripts/base/frameworks/input/port.zeek b/testing/btest/scripts/base/frameworks/input/port.zeek index 48571c5ecd..d0bb823b74 100644 --- a/testing/btest/scripts/base/frameworks/input/port.zeek +++ b/testing/btest/scripts/base/frameworks/input/port.zeek @@ -27,7 +27,7 @@ type Val: record { global servers: table[addr] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); Input::add_table([$source="../input.log", $name="input", $idx=Idx, $val=Val, $destination=servers]); diff --git a/testing/btest/scripts/base/frameworks/input/predicate-stream.zeek b/testing/btest/scripts/base/frameworks/input/predicate-stream.zeek index aac44fb8ee..f8e7f8fdf3 100644 --- a/testing/btest/scripts/base/frameworks/input/predicate-stream.zeek +++ b/testing/btest/scripts/base/frameworks/input/predicate-stream.zeek @@ -64,7 +64,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r terminate(); } -event bro_init() +event zeek_init() { outfile = open("../out"); ct = 0; diff --git a/testing/btest/scripts/base/frameworks/input/predicate.zeek b/testing/btest/scripts/base/frameworks/input/predicate.zeek index 9946e72211..171e1d42de 100644 --- a/testing/btest/scripts/base/frameworks/input/predicate.zeek +++ b/testing/btest/scripts/base/frameworks/input/predicate.zeek @@ -34,7 +34,7 @@ type Val: record { global servers: table[int] of bool = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/predicatemodify.zeek b/testing/btest/scripts/base/frameworks/input/predicatemodify.zeek index 13ed38d6ba..80e8c6aac8 100644 --- a/testing/btest/scripts/base/frameworks/input/predicatemodify.zeek +++ b/testing/btest/scripts/base/frameworks/input/predicatemodify.zeek @@ -31,7 +31,7 @@ type Val: record { global servers: table[int, string] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/predicatemodifyandreread.zeek b/testing/btest/scripts/base/frameworks/input/predicatemodifyandreread.zeek index 2c6b58ff2d..53708b4fdd 100644 --- a/testing/btest/scripts/base/frameworks/input/predicatemodifyandreread.zeek +++ b/testing/btest/scripts/base/frameworks/input/predicatemodifyandreread.zeek @@ -75,7 +75,7 @@ global servers: table[int, string] of Val = table(); global outfile: file; global try: count; -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/predicaterefusesecondsamerecord.zeek b/testing/btest/scripts/base/frameworks/input/predicaterefusesecondsamerecord.zeek index ae756431cd..6d4147ad06 100644 --- a/testing/btest/scripts/base/frameworks/input/predicaterefusesecondsamerecord.zeek +++ b/testing/btest/scripts/base/frameworks/input/predicaterefusesecondsamerecord.zeek @@ -35,7 +35,7 @@ type Val: record { global servers: table[addr] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/raw/basic.zeek b/testing/btest/scripts/base/frameworks/input/raw/basic.zeek index 377e34aca7..cb9e0269ea 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/basic.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/basic.zeek @@ -38,7 +38,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) } } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/raw/execute.zeek b/testing/btest/scripts/base/frameworks/input/raw/execute.zeek index 783b974c0f..018b62d75b 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/execute.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/execute.zeek @@ -32,7 +32,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) terminate(); } -event bro_init() +event zeek_init() { outfile = open("../out.tmp"); Input::add_event([$source="wc -l ../input.log |", $reader=Input::READER_RAW, $name="input", $fields=Val, $ev=line, $want_record=F]); diff --git a/testing/btest/scripts/base/frameworks/input/raw/executestdin.zeek b/testing/btest/scripts/base/frameworks/input/raw/executestdin.zeek index b78dd4e0e3..1c24c3ab8a 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/executestdin.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/executestdin.zeek @@ -72,7 +72,7 @@ function more_input(name_prefix: string) $config=config_strings]); } -event bro_init() +event zeek_init() { outfile = open("../out"); ++total_processes; diff --git a/testing/btest/scripts/base/frameworks/input/raw/executestream.zeek b/testing/btest/scripts/base/frameworks/input/raw/executestream.zeek index 240761ee03..ded6588269 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/executestream.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/executestream.zeek @@ -56,7 +56,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) } } -event bro_init() +event zeek_init() { outfile = open("../out"); try = 0; diff --git a/testing/btest/scripts/base/frameworks/input/raw/long.zeek b/testing/btest/scripts/base/frameworks/input/raw/long.zeek index 266021ae28..40f84c8597 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/long.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/long.zeek @@ -29,7 +29,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) } } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/raw/offset.zeek b/testing/btest/scripts/base/frameworks/input/raw/offset.zeek index f37fb9c28a..0fdb6d65e9 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/offset.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/offset.zeek @@ -33,7 +33,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) } } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek b/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek index f3dfb11ea5..ae977b4b2d 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek @@ -38,7 +38,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) } } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/raw/stderr.zeek b/testing/btest/scripts/base/frameworks/input/raw/stderr.zeek index 8ff4cc7f1b..b62b135e43 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/stderr.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/stderr.zeek @@ -54,7 +54,7 @@ event InputRaw::process_finished(name: string, source:string, exit_code:count, s terminate(); } -event bro_init() +event zeek_init() { local config_strings: table[string] of string = { ["read_stderr"] = "1" diff --git a/testing/btest/scripts/base/frameworks/input/raw/streamraw.zeek b/testing/btest/scripts/base/frameworks/input/raw/streamraw.zeek index 331db7eeb8..923428717f 100644 --- a/testing/btest/scripts/base/frameworks/input/raw/streamraw.zeek +++ b/testing/btest/scripts/base/frameworks/input/raw/streamraw.zeek @@ -56,7 +56,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string) } } -event bro_init() +event zeek_init() { outfile = open("../out"); try = 0; diff --git a/testing/btest/scripts/base/frameworks/input/repeat.zeek b/testing/btest/scripts/base/frameworks/input/repeat.zeek index 5093e30351..86245ef9f0 100644 --- a/testing/btest/scripts/base/frameworks/input/repeat.zeek +++ b/testing/btest/scripts/base/frameworks/input/repeat.zeek @@ -31,7 +31,7 @@ global destination: table[int] of bool = table(); const one_to_32: vector of count = {1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32}; -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/reread.zeek b/testing/btest/scripts/base/frameworks/input/reread.zeek index 53cb2a91a8..e34ae0a5ae 100644 --- a/testing/btest/scripts/base/frameworks/input/reread.zeek +++ b/testing/btest/scripts/base/frameworks/input/reread.zeek @@ -103,7 +103,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r print outfile, right; } -event bro_init() +event zeek_init() { outfile = open("../out"); try = 0; diff --git a/testing/btest/scripts/base/frameworks/input/set.zeek b/testing/btest/scripts/base/frameworks/input/set.zeek index d79e9ae17a..52c0b8feef 100644 --- a/testing/btest/scripts/base/frameworks/input/set.zeek +++ b/testing/btest/scripts/base/frameworks/input/set.zeek @@ -27,7 +27,7 @@ type Idx: record { global servers: set[addr] = set(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/setseparator.zeek b/testing/btest/scripts/base/frameworks/input/setseparator.zeek index 39a785236a..3e052c4b44 100644 --- a/testing/btest/scripts/base/frameworks/input/setseparator.zeek +++ b/testing/btest/scripts/base/frameworks/input/setseparator.zeek @@ -27,7 +27,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/setspecialcases.zeek b/testing/btest/scripts/base/frameworks/input/setspecialcases.zeek index 40a708f772..801a3229c5 100644 --- a/testing/btest/scripts/base/frameworks/input/setspecialcases.zeek +++ b/testing/btest/scripts/base/frameworks/input/setspecialcases.zeek @@ -31,7 +31,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/sqlite/basic.zeek b/testing/btest/scripts/base/frameworks/input/sqlite/basic.zeek index eb1411970b..fdb946e02c 100644 --- a/testing/btest/scripts/base/frameworks/input/sqlite/basic.zeek +++ b/testing/btest/scripts/base/frameworks/input/sqlite/basic.zeek @@ -86,7 +86,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, r: Conn::Inf print outfile, |r$tunnel_parents|; # to make sure I got empty right } -event bro_init() +event zeek_init() { local config_strings: table[string] of string = { ["query"] = "select * from conn;", diff --git a/testing/btest/scripts/base/frameworks/input/sqlite/error.zeek b/testing/btest/scripts/base/frameworks/input/sqlite/error.zeek index 08938e6df5..7a46160dc0 100644 --- a/testing/btest/scripts/base/frameworks/input/sqlite/error.zeek +++ b/testing/btest/scripts/base/frameworks/input/sqlite/error.zeek @@ -79,7 +79,7 @@ event term_me() terminate(); } -event bro_init() +event zeek_init() { local config_strings: table[string] of string = { ["query"] = "select * from ssh;", diff --git a/testing/btest/scripts/base/frameworks/input/sqlite/port.zeek b/testing/btest/scripts/base/frameworks/input/sqlite/port.zeek index 6fc18139fe..ddf4a844bb 100644 --- a/testing/btest/scripts/base/frameworks/input/sqlite/port.zeek +++ b/testing/btest/scripts/base/frameworks/input/sqlite/port.zeek @@ -35,7 +35,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, p: port) print outfile, p; } -event bro_init() +event zeek_init() { local config_strings: table[string] of string = { ["query"] = "select port as p, proto from port;", diff --git a/testing/btest/scripts/base/frameworks/input/sqlite/types.zeek b/testing/btest/scripts/base/frameworks/input/sqlite/types.zeek index 42f8717c12..894db886b5 100644 --- a/testing/btest/scripts/base/frameworks/input/sqlite/types.zeek +++ b/testing/btest/scripts/base/frameworks/input/sqlite/types.zeek @@ -73,7 +73,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, p: SSH::Log) print outfile, |p$vs|; } -event bro_init() +event zeek_init() { local config_strings: table[string] of string = { ["query"] = "select * from ssh;", diff --git a/testing/btest/scripts/base/frameworks/input/stream.zeek b/testing/btest/scripts/base/frameworks/input/stream.zeek index 8ed498f074..20f1b682fa 100644 --- a/testing/btest/scripts/base/frameworks/input/stream.zeek +++ b/testing/btest/scripts/base/frameworks/input/stream.zeek @@ -80,7 +80,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r } } -event bro_init() +event zeek_init() { outfile = open("../out"); try = 0; diff --git a/testing/btest/scripts/base/frameworks/input/subrecord-event.zeek b/testing/btest/scripts/base/frameworks/input/subrecord-event.zeek index ec1cc37efc..fdcef27d68 100644 --- a/testing/btest/scripts/base/frameworks/input/subrecord-event.zeek +++ b/testing/btest/scripts/base/frameworks/input/subrecord-event.zeek @@ -64,7 +64,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, value: Val) } } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/subrecord.zeek b/testing/btest/scripts/base/frameworks/input/subrecord.zeek index 0f960c6d3c..797768a7a7 100644 --- a/testing/btest/scripts/base/frameworks/input/subrecord.zeek +++ b/testing/btest/scripts/base/frameworks/input/subrecord.zeek @@ -51,7 +51,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/tableevent.zeek b/testing/btest/scripts/base/frameworks/input/tableevent.zeek index 760b19d24f..370265508d 100644 --- a/testing/btest/scripts/base/frameworks/input/tableevent.zeek +++ b/testing/btest/scripts/base/frameworks/input/tableevent.zeek @@ -47,7 +47,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r } } -event bro_init() +event zeek_init() { try = 0; outfile = open("../out"); diff --git a/testing/btest/scripts/base/frameworks/input/twotables.zeek b/testing/btest/scripts/base/frameworks/input/twotables.zeek index 5b6d833da3..12d5394a54 100644 --- a/testing/btest/scripts/base/frameworks/input/twotables.zeek +++ b/testing/btest/scripts/base/frameworks/input/twotables.zeek @@ -81,7 +81,7 @@ event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, r # print event_out, right; } -event bro_init() +event zeek_init() { event_out = open ("../event.out"); pred1_out = open ("../pred1.out"); diff --git a/testing/btest/scripts/base/frameworks/input/unsupported_types.zeek b/testing/btest/scripts/base/frameworks/input/unsupported_types.zeek index beedc0a633..3090cf10c9 100644 --- a/testing/btest/scripts/base/frameworks/input/unsupported_types.zeek +++ b/testing/btest/scripts/base/frameworks/input/unsupported_types.zeek @@ -45,7 +45,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/input/windows.zeek b/testing/btest/scripts/base/frameworks/input/windows.zeek index 275f5e0713..8addf0c6ad 100644 --- a/testing/btest/scripts/base/frameworks/input/windows.zeek +++ b/testing/btest/scripts/base/frameworks/input/windows.zeek @@ -7,11 +7,11 @@ redef exit_only_after_terminate = T; @TEST-START-FILE input.log -#separator \x09 -#path ssh -#fields b i e c p sn a d t iv s sc ss se vc ve ns -#types bool int enum count port subnet addr double time interval string table table table vector vector string -T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242 +#separator \x09 +#path ssh +#fields b i e c p sn a d t iv s sc ss se vc ve ns +#types bool int enum count port subnet addr double time interval string table table table vector vector string +T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242 @TEST-END-FILE @load base/protocols/ssh @@ -47,7 +47,7 @@ type Val: record { global servers: table[int] of Val = table(); -event bro_init() +event zeek_init() { outfile = open("../out"); # first read in the old stuff into the table... diff --git a/testing/btest/scripts/base/frameworks/intel/expire-item.zeek b/testing/btest/scripts/base/frameworks/intel/expire-item.zeek index 08d80714bc..a3a45cd1c0 100644 --- a/testing/btest/scripts/base/frameworks/intel/expire-item.zeek +++ b/testing/btest/scripts/base/frameworks/intel/expire-item.zeek @@ -61,7 +61,7 @@ hook Intel::item_expired(indicator: string, indicator_type: Intel::Type, print fmt("Expired: %s", indicator); } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { schedule 1.5sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/intel/filter-item.zeek b/testing/btest/scripts/base/frameworks/intel/filter-item.zeek index c598664996..81353ce7fc 100644 --- a/testing/btest/scripts/base/frameworks/intel/filter-item.zeek +++ b/testing/btest/scripts/base/frameworks/intel/filter-item.zeek @@ -37,7 +37,7 @@ event Intel::log_intel(rec: Intel::Info) terminate(); } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { schedule 1sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek b/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek index 8f74117201..bea8abfd88 100644 --- a/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek +++ b/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek @@ -32,7 +32,7 @@ event Intel::log_intel(rec: Intel::Info) terminate(); } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { schedule 1sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek b/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek index 8e3fe74116..9c46dd7c93 100644 --- a/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek +++ b/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek @@ -29,7 +29,7 @@ event do_it() $where=SOMEWHERE]); } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { schedule 1sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek b/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek index f262898966..0914ece60d 100644 --- a/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek @@ -45,7 +45,7 @@ event do_it() Intel::seen([$indicator="e@mail.com", $indicator_type=Intel::EMAIL, $where=Intel::IN_A_TEST]); } -event bro_init() +event zeek_init() { # Delay the workers searching for hits briefly to allow for the data distribution # mechanism to distribute the data to the workers. diff --git a/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek b/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek index 1885f5bcf8..7bc071c17a 100644 --- a/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek +++ b/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek @@ -25,7 +25,7 @@ event do_it() terminate(); } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { schedule 1sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/logging/adapt-filter.zeek b/testing/btest/scripts/base/frameworks/logging/adapt-filter.zeek index 2db881deea..d342186ca3 100644 --- a/testing/btest/scripts/base/frameworks/logging/adapt-filter.zeek +++ b/testing/btest/scripts/base/frameworks/logging/adapt-filter.zeek @@ -19,7 +19,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Info]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-binary.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-binary.zeek index fcbac3be58..1df620e19b 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-binary.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-binary.zeek @@ -15,7 +15,7 @@ export { redef LogAscii::separator = "|"; -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Info]); Log::write(SSH::LOG, [$data="abc\n\xffdef", $data2="DATA2"]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-double.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-double.zeek index 86a9716312..65bffda485 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-double.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-double.zeek @@ -23,7 +23,7 @@ function logwrite(val: double) Log::write(Test::LOG, [$d=val]); } -event bro_init() +event zeek_init() { local d: double; local dmax: double = 1.79e308; diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-empty.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-empty.zeek index 0bb5900e30..bb38f988ae 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-empty.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-empty.zeek @@ -23,7 +23,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-escape-binary.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-escape-binary.zeek index 3df3ea1d25..d7e7739547 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-escape-binary.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-escape-binary.zeek @@ -12,7 +12,7 @@ export { } &log; } -event bro_init() +event zeek_init() { local a = "abc\0def"; local b = escape_string(a); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-escape-empty-str.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-escape-empty-str.zeek index e18926a194..0145c52243 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-escape-empty-str.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-escape-empty-str.zeek @@ -14,7 +14,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(test::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-escape-notset-str.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-escape-notset-str.zeek index 8c1401b179..c42a92fdac 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-escape-notset-str.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-escape-notset-str.zeek @@ -14,7 +14,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Log]); Log::write(Test::LOG, [$x=LogAscii::unset_field, $z=""]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-escape-set-separator.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-escape-set-separator.zeek index f5fb7a6259..03139bf2b8 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-escape-set-separator.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-escape-set-separator.zeek @@ -11,7 +11,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-escape.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-escape.zeek index d73464777a..9fa6555391 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-escape.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-escape.zeek @@ -18,7 +18,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-gz-rotate.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-gz-rotate.zeek index 2a1c388322..3e73b56500 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-gz-rotate.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-gz-rotate.zeek @@ -17,7 +17,7 @@ export { redef Log::default_rotation_interval = 1hr; redef LogAscii::gzip_level = 1; -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek index 9563f42c40..74573fe3d4 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-gz.zeek @@ -42,7 +42,7 @@ function foo(i : count) : string return "Bar"; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); local filter = Log::Filter($name="ssh-uncompressed", $path="ssh-uncompressed", diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-json-iso-timestamps.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-json-iso-timestamps.zeek index 8cb1210a68..bfe998a78e 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-json-iso-timestamps.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-json-iso-timestamps.zeek @@ -17,7 +17,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::write(SSH::LOG, [ diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-json-optional.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-json-optional.zeek index e33f353d8b..364de2fe4c 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-json-optional.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-json-optional.zeek @@ -17,7 +17,7 @@ export { global log_test: event(rec: Info); } -event bro_init() &priority=5 +event zeek_init() &priority=5 { Log::create_stream(testing::LOG, [$columns=testing::Info, $ev=log_test]); local info: Info; diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-json.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-json.zeek index 2b6055930f..8985715d1d 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-json.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-json.zeek @@ -40,7 +40,7 @@ function foo(i : count) : string return "Bar"; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-line-like-comment.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-line-like-comment.zeek index 4670811b2a..33de6e720a 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-line-like-comment.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-line-like-comment.zeek @@ -13,7 +13,7 @@ export { }; } -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Info]); Log::write(Test::LOG, [$data="Test1"]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-options.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-options.zeek index 474b179536..b72f077c81 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-options.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-options.zeek @@ -19,7 +19,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-timestamps.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-timestamps.zeek index e63e30f6c6..2e786f4927 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-timestamps.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-timestamps.zeek @@ -12,7 +12,7 @@ export { }; } -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Info]); Log::write(Test::LOG, [$data=double_to_time(1234567890)]); diff --git a/testing/btest/scripts/base/frameworks/logging/ascii-tsv.zeek b/testing/btest/scripts/base/frameworks/logging/ascii-tsv.zeek index 09276a08fd..c29b291003 100644 --- a/testing/btest/scripts/base/frameworks/logging/ascii-tsv.zeek +++ b/testing/btest/scripts/base/frameworks/logging/ascii-tsv.zeek @@ -17,7 +17,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/attr-extend.zeek b/testing/btest/scripts/base/frameworks/logging/attr-extend.zeek index 7f58f3f8c1..7aece07642 100644 --- a/testing/btest/scripts/base/frameworks/logging/attr-extend.zeek +++ b/testing/btest/scripts/base/frameworks/logging/attr-extend.zeek @@ -26,7 +26,7 @@ redef record Log += { } &log; -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/attr.zeek b/testing/btest/scripts/base/frameworks/logging/attr.zeek index 8ec3d1c385..84287cc280 100644 --- a/testing/btest/scripts/base/frameworks/logging/attr.zeek +++ b/testing/btest/scripts/base/frameworks/logging/attr.zeek @@ -15,7 +15,7 @@ export { }; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/disable-stream.zeek b/testing/btest/scripts/base/frameworks/logging/disable-stream.zeek index c2f64da8e6..e3b2aa2b93 100644 --- a/testing/btest/scripts/base/frameworks/logging/disable-stream.zeek +++ b/testing/btest/scripts/base/frameworks/logging/disable-stream.zeek @@ -15,7 +15,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/empty-event.zeek b/testing/btest/scripts/base/frameworks/logging/empty-event.zeek index 6aa867220f..e7928de5c7 100644 --- a/testing/btest/scripts/base/frameworks/logging/empty-event.zeek +++ b/testing/btest/scripts/base/frameworks/logging/empty-event.zeek @@ -17,7 +17,7 @@ export { global log_ssh: event(rec: Log); -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log, $ev=log_ssh]); diff --git a/testing/btest/scripts/base/frameworks/logging/enable-stream.zeek b/testing/btest/scripts/base/frameworks/logging/enable-stream.zeek index 0f525eced1..95d02068d8 100644 --- a/testing/btest/scripts/base/frameworks/logging/enable-stream.zeek +++ b/testing/btest/scripts/base/frameworks/logging/enable-stream.zeek @@ -15,7 +15,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/events.zeek b/testing/btest/scripts/base/frameworks/logging/events.zeek index bf156e6d60..d1cf0fba7e 100644 --- a/testing/btest/scripts/base/frameworks/logging/events.zeek +++ b/testing/btest/scripts/base/frameworks/logging/events.zeek @@ -20,7 +20,7 @@ export { global ssh_log: event(rec: Log); -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log, $ev=ssh_log]); diff --git a/testing/btest/scripts/base/frameworks/logging/exclude.zeek b/testing/btest/scripts/base/frameworks/logging/exclude.zeek index 7b245541ab..b776cf91a4 100644 --- a/testing/btest/scripts/base/frameworks/logging/exclude.zeek +++ b/testing/btest/scripts/base/frameworks/logging/exclude.zeek @@ -15,7 +15,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/field-extension-cluster-error.zeek b/testing/btest/scripts/base/frameworks/logging/field-extension-cluster-error.zeek index a974a3e195..1beaa72024 100644 --- a/testing/btest/scripts/base/frameworks/logging/field-extension-cluster-error.zeek +++ b/testing/btest/scripts/base/frameworks/logging/field-extension-cluster-error.zeek @@ -62,7 +62,7 @@ event kill_worker() Broker::publish("death", slow_death); } -event bro_init() +event zeek_init() { if ( Cluster::node == "worker-1" ) { diff --git a/testing/btest/scripts/base/frameworks/logging/field-extension-cluster.zeek b/testing/btest/scripts/base/frameworks/logging/field-extension-cluster.zeek index 4159d91c59..39fe6c566a 100644 --- a/testing/btest/scripts/base/frameworks/logging/field-extension-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/logging/field-extension-cluster.zeek @@ -55,7 +55,7 @@ event kill_worker() Broker::publish("death", slow_death); } -event bro_init() +event zeek_init() { if ( Cluster::node == "worker-1" ) { diff --git a/testing/btest/scripts/base/frameworks/logging/file.zeek b/testing/btest/scripts/base/frameworks/logging/file.zeek index 94bdad6b1b..011c9bbe82 100644 --- a/testing/btest/scripts/base/frameworks/logging/file.zeek +++ b/testing/btest/scripts/base/frameworks/logging/file.zeek @@ -15,7 +15,7 @@ export { const foo_log = open_log_file("Foo") &redef; -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::write(SSH::LOG, [$t=network_time(), $f=foo_log]); diff --git a/testing/btest/scripts/base/frameworks/logging/include.zeek b/testing/btest/scripts/base/frameworks/logging/include.zeek index d0fea93c99..7179c54338 100644 --- a/testing/btest/scripts/base/frameworks/logging/include.zeek +++ b/testing/btest/scripts/base/frameworks/logging/include.zeek @@ -15,7 +15,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/no-local.zeek b/testing/btest/scripts/base/frameworks/logging/no-local.zeek index 9ae7d32d61..9418afea14 100644 --- a/testing/btest/scripts/base/frameworks/logging/no-local.zeek +++ b/testing/btest/scripts/base/frameworks/logging/no-local.zeek @@ -17,7 +17,7 @@ export { redef Log::enable_local_logging = F; -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/none-debug.zeek b/testing/btest/scripts/base/frameworks/logging/none-debug.zeek index 5d2e98323a..9a9f73d8f9 100644 --- a/testing/btest/scripts/base/frameworks/logging/none-debug.zeek +++ b/testing/btest/scripts/base/frameworks/logging/none-debug.zeek @@ -20,7 +20,7 @@ export { } &log; } -event bro_init() +event zeek_init() { local config: table[string] of string; config["foo"]="bar"; diff --git a/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek b/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek index aff886c2f4..ebb514042e 100644 --- a/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek +++ b/testing/btest/scripts/base/frameworks/logging/path-func-column-demote.zeek @@ -16,7 +16,7 @@ function split_log(id: Log::ID, path: string, rec: record {id:conn_id;}): string return Site::is_local_addr(rec$id$orig_h) ? "local" : "remote"; } -event bro_init() +event zeek_init() { # Add a new filter to the Conn::LOG stream that logs only # timestamp and originator address. diff --git a/testing/btest/scripts/base/frameworks/logging/path-func.zeek b/testing/btest/scripts/base/frameworks/logging/path-func.zeek index 684aa03ed6..fa52cccc48 100644 --- a/testing/btest/scripts/base/frameworks/logging/path-func.zeek +++ b/testing/btest/scripts/base/frameworks/logging/path-func.zeek @@ -28,7 +28,7 @@ function path_func(id: Log::ID, path: string, rec: Log) : string return fmt("%s-%d-%s", path, c, rec$country); } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::remove_default_filter(SSH::LOG); diff --git a/testing/btest/scripts/base/frameworks/logging/pred.zeek b/testing/btest/scripts/base/frameworks/logging/pred.zeek index e13c726656..c6f85183b4 100644 --- a/testing/btest/scripts/base/frameworks/logging/pred.zeek +++ b/testing/btest/scripts/base/frameworks/logging/pred.zeek @@ -24,7 +24,7 @@ function fail(rec: Log): bool return rec$status != "success"; } -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Log]); Log::remove_default_filter(Test::LOG); diff --git a/testing/btest/scripts/base/frameworks/logging/remove.zeek b/testing/btest/scripts/base/frameworks/logging/remove.zeek index 3b80d24e9f..2247648e7c 100644 --- a/testing/btest/scripts/base/frameworks/logging/remove.zeek +++ b/testing/btest/scripts/base/frameworks/logging/remove.zeek @@ -20,7 +20,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $pred=function(rec: Log): bool { return rec$status == "failure"; }]); diff --git a/testing/btest/scripts/base/frameworks/logging/rotate-custom.zeek b/testing/btest/scripts/base/frameworks/logging/rotate-custom.zeek index c0f0ef8643..89264fa6e5 100644 --- a/testing/btest/scripts/base/frameworks/logging/rotate-custom.zeek +++ b/testing/btest/scripts/base/frameworks/logging/rotate-custom.zeek @@ -28,7 +28,7 @@ function custom_rotate(info: Log::RotationInfo) : bool return T; } -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Log]); Log::add_filter(Test::LOG, [$name="2nd", $path="test2", $interv=30mins, $postprocessor=custom_rotate]); diff --git a/testing/btest/scripts/base/frameworks/logging/rotate.zeek b/testing/btest/scripts/base/frameworks/logging/rotate.zeek index 501c0db8ea..2a988a88f0 100644 --- a/testing/btest/scripts/base/frameworks/logging/rotate.zeek +++ b/testing/btest/scripts/base/frameworks/logging/rotate.zeek @@ -21,7 +21,7 @@ export { redef Log::default_rotation_interval = 1hr; redef Log::default_rotation_postprocessor_cmd = "echo"; -event bro_init() +event zeek_init() { Log::create_stream(Test::LOG, [$columns=Log]); } diff --git a/testing/btest/scripts/base/frameworks/logging/sqlite/error.zeek b/testing/btest/scripts/base/frameworks/logging/sqlite/error.zeek index e48e066c6c..d453804858 100644 --- a/testing/btest/scripts/base/frameworks/logging/sqlite/error.zeek +++ b/testing/btest/scripts/base/frameworks/logging/sqlite/error.zeek @@ -73,7 +73,7 @@ function foo(i : count) : string return "Bar"; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::remove_filter(SSH::LOG, "default"); diff --git a/testing/btest/scripts/base/frameworks/logging/sqlite/set.zeek b/testing/btest/scripts/base/frameworks/logging/sqlite/set.zeek index 0cceb7af08..8612cd5765 100644 --- a/testing/btest/scripts/base/frameworks/logging/sqlite/set.zeek +++ b/testing/btest/scripts/base/frameworks/logging/sqlite/set.zeek @@ -32,7 +32,7 @@ function foo(i : count) : string return "Bar"; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::remove_filter(SSH::LOG, "default"); diff --git a/testing/btest/scripts/base/frameworks/logging/sqlite/simultaneous-writes.zeek b/testing/btest/scripts/base/frameworks/logging/sqlite/simultaneous-writes.zeek index 2e864aa791..7f9ea2d870 100644 --- a/testing/btest/scripts/base/frameworks/logging/sqlite/simultaneous-writes.zeek +++ b/testing/btest/scripts/base/frameworks/logging/sqlite/simultaneous-writes.zeek @@ -47,7 +47,7 @@ function foo(i : count) : string return "Bar"; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::create_stream(SSH::LOG2, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/sqlite/types.zeek b/testing/btest/scripts/base/frameworks/logging/sqlite/types.zeek index 6c088e9f2f..e878ec32d3 100644 --- a/testing/btest/scripts/base/frameworks/logging/sqlite/types.zeek +++ b/testing/btest/scripts/base/frameworks/logging/sqlite/types.zeek @@ -45,7 +45,7 @@ function foo(i : count) : string return "Bar"; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); Log::remove_filter(SSH::LOG, "default"); diff --git a/testing/btest/scripts/base/frameworks/logging/stdout.zeek b/testing/btest/scripts/base/frameworks/logging/stdout.zeek index f431a5b6c9..bce55fd0ca 100644 --- a/testing/btest/scripts/base/frameworks/logging/stdout.zeek +++ b/testing/btest/scripts/base/frameworks/logging/stdout.zeek @@ -16,7 +16,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/test-logging.zeek b/testing/btest/scripts/base/frameworks/logging/test-logging.zeek index 9f90d515fb..f7d07e843a 100644 --- a/testing/btest/scripts/base/frameworks/logging/test-logging.zeek +++ b/testing/btest/scripts/base/frameworks/logging/test-logging.zeek @@ -15,7 +15,7 @@ export { } &log; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/types.zeek b/testing/btest/scripts/base/frameworks/logging/types.zeek index d79c667e50..9d208335ad 100644 --- a/testing/btest/scripts/base/frameworks/logging/types.zeek +++ b/testing/btest/scripts/base/frameworks/logging/types.zeek @@ -40,7 +40,7 @@ function foo(i : count) : string return "Bar"; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/unset-record.zeek b/testing/btest/scripts/base/frameworks/logging/unset-record.zeek index bb922dc9c8..00f97ffc1a 100644 --- a/testing/btest/scripts/base/frameworks/logging/unset-record.zeek +++ b/testing/btest/scripts/base/frameworks/logging/unset-record.zeek @@ -14,7 +14,7 @@ type Bar: record { b: count &log; }; -event bro_init() +event zeek_init() { Log::create_stream(TESTING, [$columns=Bar]); diff --git a/testing/btest/scripts/base/frameworks/logging/vec.zeek b/testing/btest/scripts/base/frameworks/logging/vec.zeek index 00c5ff5117..6809e132bc 100644 --- a/testing/btest/scripts/base/frameworks/logging/vec.zeek +++ b/testing/btest/scripts/base/frameworks/logging/vec.zeek @@ -12,7 +12,7 @@ export { }; } -event bro_init() +event zeek_init() { Log::create_stream(SSH::LOG, [$columns=Log]); diff --git a/testing/btest/scripts/base/frameworks/logging/writer-path-conflict.zeek b/testing/btest/scripts/base/frameworks/logging/writer-path-conflict.zeek index 908fb43c72..916e5a6775 100644 --- a/testing/btest/scripts/base/frameworks/logging/writer-path-conflict.zeek +++ b/testing/btest/scripts/base/frameworks/logging/writer-path-conflict.zeek @@ -7,7 +7,7 @@ @load base/protocols/http -event bro_init() +event zeek_init() { # Both the default filter for the http stream and this new one will # attempt to have the same writer write to path "http", which will diff --git a/testing/btest/scripts/base/frameworks/netcontrol/acld-hook.zeek b/testing/btest/scripts/base/frameworks/netcontrol/acld-hook.zeek index 4aadb33417..5561b3b674 100644 --- a/testing/btest/scripts/base/frameworks/netcontrol/acld-hook.zeek +++ b/testing/btest/scripts/base/frameworks/netcontrol/acld-hook.zeek @@ -14,7 +14,7 @@ redef exit_only_after_terminate = T; global have_peer = F; global did_init = F; -event bro_init() +event zeek_init() { suspend_processing(); } @@ -101,7 +101,7 @@ event die() terminate(); } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/netcontroltest"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/scripts/base/frameworks/netcontrol/acld.zeek b/testing/btest/scripts/base/frameworks/netcontrol/acld.zeek index 91591336c3..94fda84c64 100644 --- a/testing/btest/scripts/base/frameworks/netcontrol/acld.zeek +++ b/testing/btest/scripts/base/frameworks/netcontrol/acld.zeek @@ -15,7 +15,7 @@ redef exit_only_after_terminate = T; global have_peer = F; global did_init = F; -event bro_init() +event zeek_init() { suspend_processing(); } @@ -106,7 +106,7 @@ event die() terminate(); } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/netcontroltest"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/scripts/base/frameworks/netcontrol/basic-cluster.zeek b/testing/btest/scripts/base/frameworks/netcontrol/basic-cluster.zeek index ec619f5b6b..3f3ecb5e60 100644 --- a/testing/btest/scripts/base/frameworks/netcontrol/basic-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/netcontrol/basic-cluster.zeek @@ -26,7 +26,7 @@ redef Log::default_rotation_interval = 0secs; @load base/frameworks/netcontrol @if ( Cluster::local_node_type() == Cluster::WORKER ) -event bro_init() +event zeek_init() { suspend_processing(); } diff --git a/testing/btest/scripts/base/frameworks/netcontrol/broker.zeek b/testing/btest/scripts/base/frameworks/netcontrol/broker.zeek index 9933e635c6..bf8957e4ff 100644 --- a/testing/btest/scripts/base/frameworks/netcontrol/broker.zeek +++ b/testing/btest/scripts/base/frameworks/netcontrol/broker.zeek @@ -15,7 +15,7 @@ redef exit_only_after_terminate = T; global have_peer = F; global did_init = F; -event bro_init() +event zeek_init() { suspend_processing(); } @@ -90,7 +90,7 @@ event die() terminate(); } -event bro_init() +event zeek_init() { Broker::subscribe("bro/event/netcontroltest"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/scripts/base/frameworks/notice/suppression-disable.zeek b/testing/btest/scripts/base/frameworks/notice/suppression-disable.zeek index 96b932caf8..5eeab5bff2 100644 --- a/testing/btest/scripts/base/frameworks/notice/suppression-disable.zeek +++ b/testing/btest/scripts/base/frameworks/notice/suppression-disable.zeek @@ -18,7 +18,7 @@ event second_notice() NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]); } -event bro_init() +event zeek_init() { NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]); schedule 1msec { second_notice() }; diff --git a/testing/btest/scripts/base/frameworks/notice/suppression.zeek b/testing/btest/scripts/base/frameworks/notice/suppression.zeek index 87ce3672b6..d91aa17a2e 100644 --- a/testing/btest/scripts/base/frameworks/notice/suppression.zeek +++ b/testing/btest/scripts/base/frameworks/notice/suppression.zeek @@ -15,7 +15,7 @@ event second_notice() NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]); } -event bro_init() +event zeek_init() { NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]); schedule 1msec { second_notice() }; diff --git a/testing/btest/scripts/base/frameworks/openflow/broker-basic.zeek b/testing/btest/scripts/base/frameworks/openflow/broker-basic.zeek index c46c00d2f3..3cce7bda1e 100644 --- a/testing/btest/scripts/base/frameworks/openflow/broker-basic.zeek +++ b/testing/btest/scripts/base/frameworks/openflow/broker-basic.zeek @@ -15,7 +15,7 @@ redef exit_only_after_terminate = T; global of_controller: OpenFlow::Controller; -event bro_init() +event zeek_init() { suspend_processing(); of_controller = OpenFlow::broker_new("broker1", 127.0.0.1, to_port(getenv("BROKER_PORT")), "bro/openflow", 42); @@ -80,7 +80,7 @@ event die() terminate(); } -event bro_init() +event zeek_init() { Broker::subscribe("bro/openflow"); Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT"))); diff --git a/testing/btest/scripts/base/frameworks/openflow/log-basic.zeek b/testing/btest/scripts/base/frameworks/openflow/log-basic.zeek index d4f08e7822..5aa615f691 100644 --- a/testing/btest/scripts/base/frameworks/openflow/log-basic.zeek +++ b/testing/btest/scripts/base/frameworks/openflow/log-basic.zeek @@ -8,7 +8,7 @@ global of_controller: OpenFlow::Controller; global cookie_id: count = 42; -event bro_init() +event zeek_init() { of_controller = OpenFlow::log_new(42); diff --git a/testing/btest/scripts/base/frameworks/openflow/log-cluster.zeek b/testing/btest/scripts/base/frameworks/openflow/log-cluster.zeek index 08cfbb581d..c6a9e90cb4 100644 --- a/testing/btest/scripts/base/frameworks/openflow/log-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/openflow/log-cluster.zeek @@ -22,7 +22,7 @@ redef Log::default_rotation_interval = 0secs; global of_controller: OpenFlow::Controller; @if ( Cluster::local_node_type() == Cluster::WORKER ) -event bro_init() +event zeek_init() { suspend_processing(); } @@ -33,7 +33,7 @@ event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string) } @endif -event bro_init() +event zeek_init() { of_controller = OpenFlow::log_new(42); } diff --git a/testing/btest/scripts/base/frameworks/openflow/ryu-basic.zeek b/testing/btest/scripts/base/frameworks/openflow/ryu-basic.zeek index 3bfaa4c076..9df9822450 100644 --- a/testing/btest/scripts/base/frameworks/openflow/ryu-basic.zeek +++ b/testing/btest/scripts/base/frameworks/openflow/ryu-basic.zeek @@ -6,7 +6,7 @@ global of_controller: OpenFlow::Controller; -event bro_init() +event zeek_init() { of_controller = OpenFlow::ryu_new(127.0.0.1, 8080, 42); of_controller$state$ryu_debug=T; diff --git a/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek b/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek index b1afb99b5c..bf449e886d 100644 --- a/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek +++ b/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek @@ -7,7 +7,7 @@ redef Reporter::errors_to_stderr = F; global test: table[count] of string = {}; -event bro_init() +event zeek_init() { print test[3]; } diff --git a/testing/btest/scripts/base/frameworks/reporter/stderr.zeek b/testing/btest/scripts/base/frameworks/reporter/stderr.zeek index ef01c9fdf9..6b878ceef5 100644 --- a/testing/btest/scripts/base/frameworks/reporter/stderr.zeek +++ b/testing/btest/scripts/base/frameworks/reporter/stderr.zeek @@ -4,7 +4,7 @@ global test: table[count] of string = {}; -event bro_init() +event zeek_init() { print test[3]; } diff --git a/testing/btest/scripts/base/frameworks/software/version-parsing.zeek b/testing/btest/scripts/base/frameworks/software/version-parsing.zeek index 806a058a03..fd43145826 100644 --- a/testing/btest/scripts/base/frameworks/software/version-parsing.zeek +++ b/testing/btest/scripts/base/frameworks/software/version-parsing.zeek @@ -133,7 +133,7 @@ global matched_software: table[string] of Software::Description = { [$name="Android (Google Pixel)", $version=[$major=9], $unparsed_version=""], }; -event bro_init() +event zeek_init() { for ( sw in matched_software ) { diff --git a/testing/btest/scripts/base/frameworks/sumstats/basic-cluster.zeek b/testing/btest/scripts/base/frameworks/sumstats/basic-cluster.zeek index d611d29907..726aa09416 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/basic-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/basic-cluster.zeek @@ -21,7 +21,7 @@ redef Log::default_rotation_interval = 0secs; global n = 0; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test", $apply=set(SumStats::SUM, SumStats::MIN, SumStats::MAX, SumStats::AVERAGE, SumStats::STD_DEV, SumStats::VARIANCE, SumStats::UNIQUE, SumStats::HLL_UNIQUE)]; SumStats::create([$name="test", @@ -71,7 +71,7 @@ event ready_for_data() @if ( Cluster::local_node_type() == Cluster::MANAGER ) -event bro_init() &priority=100 +event zeek_init() &priority=100 { Broker::auto_publish(Cluster::worker_topic, ready_for_data); } diff --git a/testing/btest/scripts/base/frameworks/sumstats/basic.zeek b/testing/btest/scripts/base/frameworks/sumstats/basic.zeek index 40f269ab1a..1362c739cf 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/basic.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/basic.zeek @@ -4,7 +4,7 @@ redef exit_only_after_terminate=T; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test.metric", $apply=set(SumStats::SUM, diff --git a/testing/btest/scripts/base/frameworks/sumstats/cluster-intermediate-update.zeek b/testing/btest/scripts/base/frameworks/sumstats/cluster-intermediate-update.zeek index 5bda9e3705..04cdcca725 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/cluster-intermediate-update.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/cluster-intermediate-update.zeek @@ -18,7 +18,7 @@ redef Cluster::nodes = { redef Log::default_rotation_interval = 0secs; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test.metric", $apply=set(SumStats::SUM)]; SumStats::create([$name="test", diff --git a/testing/btest/scripts/base/frameworks/sumstats/last-cluster.zeek b/testing/btest/scripts/base/frameworks/sumstats/last-cluster.zeek index 00dab1212b..4482b43524 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/last-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/last-cluster.zeek @@ -27,7 +27,7 @@ event do_observe() schedule 0.1secs { do_observe() }; } -event bro_init() +event zeek_init() { local r1 = SumStats::Reducer($stream="test", $apply=set(SumStats::LAST), diff --git a/testing/btest/scripts/base/frameworks/sumstats/on-demand-cluster.zeek b/testing/btest/scripts/base/frameworks/sumstats/on-demand-cluster.zeek index 2c5621743f..3ab0492f29 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/on-demand-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/on-demand-cluster.zeek @@ -22,7 +22,7 @@ redef Log::default_rotation_interval = 0secs; global n = 0; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1 = SumStats::Reducer($stream="test", $apply=set(SumStats::SUM, SumStats::MIN, SumStats::MAX, SumStats::AVERAGE, SumStats::STD_DEV, SumStats::VARIANCE, SumStats::UNIQUE)); SumStats::create([$name="test sumstat", @@ -37,7 +37,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) global ready_for_data: event(); -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, ready_for_data); } diff --git a/testing/btest/scripts/base/frameworks/sumstats/on-demand.zeek b/testing/btest/scripts/base/frameworks/sumstats/on-demand.zeek index 78aba726ca..99658ad7d0 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/on-demand.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/on-demand.zeek @@ -28,7 +28,7 @@ event on_demand_key() } } -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test.reducer", $apply=set(SumStats::SUM)]; diff --git a/testing/btest/scripts/base/frameworks/sumstats/sample-cluster.zeek b/testing/btest/scripts/base/frameworks/sumstats/sample-cluster.zeek index 088b3c9c14..44dcd3abd4 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/sample-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/sample-cluster.zeek @@ -18,7 +18,7 @@ redef Cluster::nodes = { redef Log::default_rotation_interval = 0secs; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test", $apply=set(SumStats::SAMPLE), $num_samples=5]; SumStats::create([$name="test", @@ -47,7 +47,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) global ready_for_data: event(); -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, ready_for_data); diff --git a/testing/btest/scripts/base/frameworks/sumstats/sample.zeek b/testing/btest/scripts/base/frameworks/sumstats/sample.zeek index 4ba395b463..30e80b1b49 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/sample.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/sample.zeek @@ -1,7 +1,7 @@ # @TEST-EXEC: bro %INPUT # @TEST-EXEC: btest-diff .stdout -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test.metric", $apply=set(SumStats::SAMPLE), $num_samples=2]; diff --git a/testing/btest/scripts/base/frameworks/sumstats/thresholding.zeek b/testing/btest/scripts/base/frameworks/sumstats/thresholding.zeek index b7bb826446..f751a85e98 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/thresholding.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/thresholding.zeek @@ -5,7 +5,7 @@ redef enum Notice::Type += { Test_Notice, }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test.metric", $apply=set(SumStats::SUM)]; SumStats::create([$name="test1", diff --git a/testing/btest/scripts/base/frameworks/sumstats/topk-cluster.zeek b/testing/btest/scripts/base/frameworks/sumstats/topk-cluster.zeek index f26eca11cf..e32e417cc5 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/topk-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/topk-cluster.zeek @@ -20,7 +20,7 @@ redef Cluster::nodes = { redef Log::default_rotation_interval = 0secs; -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test.metric", $apply=set(SumStats::TOPK)]; @@ -53,7 +53,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) global ready_for_data: event(); -event bro_init() +event zeek_init() { Broker::auto_publish(Cluster::worker_topic, ready_for_data); } diff --git a/testing/btest/scripts/base/frameworks/sumstats/topk.zeek b/testing/btest/scripts/base/frameworks/sumstats/topk.zeek index 0d0a49b191..0b7ae1ea2f 100644 --- a/testing/btest/scripts/base/frameworks/sumstats/topk.zeek +++ b/testing/btest/scripts/base/frameworks/sumstats/topk.zeek @@ -1,7 +1,7 @@ # @TEST-EXEC: bro %INPUT # @TEST-EXEC: btest-diff .stdout -event bro_init() &priority=5 +event zeek_init() &priority=5 { local r1: SumStats::Reducer = [$stream="test.metric", $apply=set(SumStats::TOPK)]; diff --git a/testing/btest/scripts/base/protocols/http/content-range-gap-skip.zeek b/testing/btest/scripts/base/protocols/http/content-range-gap-skip.zeek index b96b8f02a6..74ce213505 100644 --- a/testing/btest/scripts/base/protocols/http/content-range-gap-skip.zeek +++ b/testing/btest/scripts/base/protocols/http/content-range-gap-skip.zeek @@ -19,7 +19,7 @@ event content_gap(c: connection, is_orig: bool, seq: count, length: count) got_gap = T; } -event bro_done() +event zeek_done() { if ( ! got_data_after_gap ) exit(1); diff --git a/testing/btest/scripts/base/protocols/http/http-pipelining.zeek b/testing/btest/scripts/base/protocols/http/http-pipelining.zeek index bb392b1c4b..afb1a7f33e 100644 --- a/testing/btest/scripts/base/protocols/http/http-pipelining.zeek +++ b/testing/btest/scripts/base/protocols/http/http-pipelining.zeek @@ -2,7 +2,7 @@ # @TEST-EXEC: btest-diff http.log # mime type is irrelevant to this test, so filter it out -event bro_init() +event zeek_init() { Log::remove_default_filter(HTTP::LOG); Log::add_filter(HTTP::LOG, [$name="less-mime-types", $exclude=set("mime_type")]); diff --git a/testing/btest/scripts/base/protocols/irc/basic.test b/testing/btest/scripts/base/protocols/irc/basic.test index 618f4d9079..d4fb893e2c 100644 --- a/testing/btest/scripts/base/protocols/irc/basic.test +++ b/testing/btest/scripts/base/protocols/irc/basic.test @@ -6,7 +6,7 @@ # @TEST-EXEC: btest-diff conn.log # dcc mime types are irrelevant to this test, so filter it out -event bro_init() +event zeek_init() { Log::remove_default_filter(IRC::LOG); Log::add_filter(IRC::LOG, [$name="remove-mime", $exclude=set("dcc_mime_type")]); diff --git a/testing/btest/scripts/base/protocols/krb/smb2_krb.test b/testing/btest/scripts/base/protocols/krb/smb2_krb.test index 08c05d83f1..32c2a6e58d 100644 --- a/testing/btest/scripts/base/protocols/krb/smb2_krb.test +++ b/testing/btest/scripts/base/protocols/krb/smb2_krb.test @@ -11,7 +11,7 @@ redef KRB::keytab = "smb2_krb.keytab"; global monitor_ports: set[port] = { 445/tcp, 139/tcp } &redef; -event bro_init() &priority=5{ +event zeek_init() &priority=5{ Analyzer::register_for_ports(Analyzer::ANALYZER_SMB, monitor_ports); } diff --git a/testing/btest/scripts/base/protocols/krb/smb2_krb_nokeytab.test b/testing/btest/scripts/base/protocols/krb/smb2_krb_nokeytab.test index 0d2c68d142..d08543a0fb 100644 --- a/testing/btest/scripts/base/protocols/krb/smb2_krb_nokeytab.test +++ b/testing/btest/scripts/base/protocols/krb/smb2_krb_nokeytab.test @@ -10,7 +10,7 @@ global monitor_ports: set[port] = { 445/tcp, 139/tcp } &redef; -event bro_init() &priority=5{ +event zeek_init() &priority=5{ Analyzer::register_for_ports(Analyzer::ANALYZER_SMB, monitor_ports); } diff --git a/testing/btest/scripts/base/protocols/mount/basic.test b/testing/btest/scripts/base/protocols/mount/basic.test index 8576874ce3..bd6fd5d5db 100644 --- a/testing/btest/scripts/base/protocols/mount/basic.test +++ b/testing/btest/scripts/base/protocols/mount/basic.test @@ -4,7 +4,7 @@ global mount_ports: set[port] = { 635/tcp, 635/udp, 20048/tcp, 20048/udp } &redef; redef ignore_checksums = T; -event bro_init() +event zeek_init() { Analyzer::register_for_ports(Analyzer::ANALYZER_MOUNT, mount_ports); Analyzer::enable_analyzer(Analyzer::ANALYZER_MOUNT); diff --git a/testing/btest/scripts/base/protocols/ncp/event.zeek b/testing/btest/scripts/base/protocols/ncp/event.zeek index acb4bf0a0c..2333544b05 100644 --- a/testing/btest/scripts/base/protocols/ncp/event.zeek +++ b/testing/btest/scripts/base/protocols/ncp/event.zeek @@ -3,7 +3,7 @@ redef likely_server_ports += { 524/tcp }; -event bro_init() +event zeek_init() { const ports = { 524/tcp }; Analyzer::register_for_ports(Analyzer::ANALYZER_NCP, ports); diff --git a/testing/btest/scripts/base/protocols/ncp/frame_size_tuning.zeek b/testing/btest/scripts/base/protocols/ncp/frame_size_tuning.zeek index 46ad87e752..cc4a5799f2 100644 --- a/testing/btest/scripts/base/protocols/ncp/frame_size_tuning.zeek +++ b/testing/btest/scripts/base/protocols/ncp/frame_size_tuning.zeek @@ -3,7 +3,7 @@ redef likely_server_ports += { 524/tcp }; -event bro_init() +event zeek_init() { const ports = { 524/tcp }; Analyzer::register_for_ports(Analyzer::ANALYZER_NCP, ports); diff --git a/testing/btest/scripts/base/protocols/nfs/basic.test b/testing/btest/scripts/base/protocols/nfs/basic.test index f2d2b1862a..9b7ae91910 100755 --- a/testing/btest/scripts/base/protocols/nfs/basic.test +++ b/testing/btest/scripts/base/protocols/nfs/basic.test @@ -4,7 +4,7 @@ global nfs_ports: set[port] = { 2049/tcp, 2049/udp } &redef; redef ignore_checksums = T; -event bro_init() +event zeek_init() { Analyzer::register_for_ports(Analyzer::ANALYZER_NFS, nfs_ports); Analyzer::enable_analyzer(Analyzer::ANALYZER_NFS); diff --git a/testing/btest/scripts/base/protocols/pop3/starttls.zeek b/testing/btest/scripts/base/protocols/pop3/starttls.zeek index 8e0d1ab5ef..d2bfee6449 100644 --- a/testing/btest/scripts/base/protocols/pop3/starttls.zeek +++ b/testing/btest/scripts/base/protocols/pop3/starttls.zeek @@ -14,7 +14,7 @@ const ports = { }; redef likely_server_ports += { ports }; -event bro_init() &priority=5 +event zeek_init() &priority=5 { Analyzer::register_for_ports(Analyzer::ANALYZER_POP3, ports); } diff --git a/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test b/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test index 627e396517..d65ee81c41 100644 --- a/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test +++ b/testing/btest/scripts/base/protocols/smb/disabled-dce-rpc.test @@ -6,7 +6,7 @@ # The DCE_RPC analyzer is a little weird since it's instantiated # by the SMB analyzer directly in some cases. Care needs to be # taken to handle a disabled analyzer correctly. -event bro_init() +event zeek_init() { Analyzer::disable_analyzer(Analyzer::ANALYZER_DCE_RPC); } diff --git a/testing/btest/scripts/base/protocols/ssl/dpd.test b/testing/btest/scripts/base/protocols/ssl/dpd.test index 1a16a10db4..20b6ab6b74 100644 --- a/testing/btest/scripts/base/protocols/ssl/dpd.test +++ b/testing/btest/scripts/base/protocols/ssl/dpd.test @@ -9,7 +9,7 @@ @load base/frameworks/signatures @load-sigs base/protocols/ssl/dpd.sig -event bro_init() +event zeek_init() { print "Start test run"; } diff --git a/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test b/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test index c8721529c9..e8731bb1be 100644 --- a/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test +++ b/testing/btest/scripts/base/protocols/ssl/dtls-no-dtls.test @@ -3,7 +3,7 @@ # @TEST-EXEC: bro -C -r $TRACES/dns-txt-multiple.trace %INPUT # @TEST-EXEC: btest-diff .stdout -event bro_init() +event zeek_init() { const add_ports = { 53/udp }; Analyzer::register_for_ports(Analyzer::ANALYZER_DTLS, add_ports); diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test b/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test index c8c8acc589..181ee34909 100644 --- a/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test +++ b/testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test @@ -6,7 +6,7 @@ @load files/x509/log-ocsp -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request"); Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test b/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test index 05483717b0..ff493a62a8 100644 --- a/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test +++ b/testing/btest/scripts/base/protocols/ssl/ocsp-request-only.test @@ -5,7 +5,7 @@ @load files/x509/log-ocsp -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request"); Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-request-response.test b/testing/btest/scripts/base/protocols/ssl/ocsp-request-response.test index b95203dfd8..cfa5b99375 100644 --- a/testing/btest/scripts/base/protocols/ssl/ocsp-request-response.test +++ b/testing/btest/scripts/base/protocols/ssl/ocsp-request-response.test @@ -6,7 +6,7 @@ @load files/x509/log-ocsp -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request"); Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-response-only.test b/testing/btest/scripts/base/protocols/ssl/ocsp-response-only.test index 43dbf82583..3b8c4a2d57 100644 --- a/testing/btest/scripts/base/protocols/ssl/ocsp-response-only.test +++ b/testing/btest/scripts/base/protocols/ssl/ocsp-response-only.test @@ -6,7 +6,7 @@ @load files/x509/log-ocsp -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request"); Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); diff --git a/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test b/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test index e4378135ad..3ee0e96776 100644 --- a/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test +++ b/testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test @@ -6,7 +6,7 @@ @load files/x509/log-ocsp -event bro_init() +event zeek_init() { Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request"); Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response"); diff --git a/testing/btest/scripts/base/utils/active-http.test b/testing/btest/scripts/base/utils/active-http.test index 97d06448ca..9f94a14c7f 100644 --- a/testing/btest/scripts/base/utils/active-http.test +++ b/testing/btest/scripts/base/utils/active-http.test @@ -35,7 +35,7 @@ function test_request(label: string, req: ActiveHTTP::Request) } } -event bro_init() +event zeek_init() { test_request("test1", [$url="127.0.0.1:32123"]); test_request("test2", [$url="127.0.0.1:32123/empty", $method="POST"]); diff --git a/testing/btest/scripts/base/utils/addrs.test b/testing/btest/scripts/base/utils/addrs.test index 224fd9dc62..8e5580d3e5 100644 --- a/testing/btest/scripts/base/utils/addrs.test +++ b/testing/btest/scripts/base/utils/addrs.test @@ -3,7 +3,7 @@ @load base/utils/addrs -event bro_init() +event zeek_init() { local ip = "0.0.0.0"; diff --git a/testing/btest/scripts/base/utils/decompose_uri.zeek b/testing/btest/scripts/base/utils/decompose_uri.zeek index 6ed30e7889..074e782474 100644 --- a/testing/btest/scripts/base/utils/decompose_uri.zeek +++ b/testing/btest/scripts/base/utils/decompose_uri.zeek @@ -10,7 +10,7 @@ function dc(s: string) print ""; } -event bro_init() +event zeek_init() { dc("https://www.bro.org:42/documentation/faq.html?k1=v1&k2=v2"); dc(""); diff --git a/testing/btest/scripts/base/utils/dir.test b/testing/btest/scripts/base/utils/dir.test index d7071e1d4c..c02f215d51 100644 --- a/testing/btest/scripts/base/utils/dir.test +++ b/testing/btest/scripts/base/utils/dir.test @@ -47,7 +47,7 @@ function new_file(fname: string) terminate(); } -event bro_init() +event zeek_init() { Dir::monitor("../testdir", new_file, .25sec); } diff --git a/testing/btest/scripts/base/utils/directions-and-hosts.test b/testing/btest/scripts/base/utils/directions-and-hosts.test index 92d1b48d3a..a955053d4a 100644 --- a/testing/btest/scripts/base/utils/directions-and-hosts.test +++ b/testing/btest/scripts/base/utils/directions-and-hosts.test @@ -40,7 +40,7 @@ function test_dir(id: conn_id, d: Direction, expect: bool) result == expect ? "SUCCESS" : "FAIL"); } -event bro_init() +event zeek_init() { test_host(local_ip, LOCAL_HOSTS, T); test_host(local_ip, REMOTE_HOSTS, F); diff --git a/testing/btest/scripts/base/utils/exec.test b/testing/btest/scripts/base/utils/exec.test index d761587f31..8913ed025c 100644 --- a/testing/btest/scripts/base/utils/exec.test +++ b/testing/btest/scripts/base/utils/exec.test @@ -26,7 +26,7 @@ function test_cmd(label: string, cmd: Exec::Command) } } -event bro_init() +event zeek_init() { test_cmd("test1", [$cmd="bash ../somescript.sh", $read_files=set("out1", "out2")]); diff --git a/testing/btest/scripts/base/utils/files.test b/testing/btest/scripts/base/utils/files.test index 3324522030..402da96bed 100644 --- a/testing/btest/scripts/base/utils/files.test +++ b/testing/btest/scripts/base/utils/files.test @@ -12,9 +12,9 @@ event connection_established(c: connection) print generate_extraction_filename("", c, ""); } -event bro_init() +event zeek_init() { print extract_filename_from_content_disposition("attachment; filename=Economy"); print extract_filename_from_content_disposition("attachment; name=\"US-$ rates\""); print extract_filename_from_content_disposition("attachment; filename*=iso-8859-1'en'%A3%20rates"); - } \ No newline at end of file + } diff --git a/testing/btest/scripts/base/utils/json.test b/testing/btest/scripts/base/utils/json.test index 264151136a..968db1cefe 100644 --- a/testing/btest/scripts/base/utils/json.test +++ b/testing/btest/scripts/base/utils/json.test @@ -16,7 +16,7 @@ type myrec2: record { m: myrec1 &log; }; -event bro_init() +event zeek_init() { # ##################################### # Test the basic (non-container) types: diff --git a/testing/btest/scripts/base/utils/queue.test b/testing/btest/scripts/base/utils/queue.test index 344ea73f45..b11cac233f 100644 --- a/testing/btest/scripts/base/utils/queue.test +++ b/testing/btest/scripts/base/utils/queue.test @@ -4,7 +4,7 @@ # This is loaded by default @load base/utils/queue -event bro_init() +event zeek_init() { local q = Queue::init([$max_len=2]); Queue::put(q, 1); @@ -30,4 +30,4 @@ event bro_init() Queue::get_vector(q2, test3); for ( i in test3 ) print fmt("String queue value: %s", test3[i]); - } \ No newline at end of file + } diff --git a/testing/btest/scripts/base/utils/site.test b/testing/btest/scripts/base/utils/site.test index cfd7dd2ceb..50438a0b9c 100644 --- a/testing/btest/scripts/base/utils/site.test +++ b/testing/btest/scripts/base/utils/site.test @@ -12,7 +12,7 @@ redef Site::local_admins += { [141.142.100.0/24] = b, }; -event bro_init() +event zeek_init() { print Site::get_emails(141.142.1.1); print Site::get_emails(141.142.100.100); diff --git a/testing/btest/scripts/policy/frameworks/intel/removal.zeek b/testing/btest/scripts/policy/frameworks/intel/removal.zeek index 4d7e450da4..41c87bc6fb 100644 --- a/testing/btest/scripts/policy/frameworks/intel/removal.zeek +++ b/testing/btest/scripts/policy/frameworks/intel/removal.zeek @@ -38,9 +38,9 @@ event Intel::log_intel(rec: Intel::Info) terminate(); } -event bro_init() &priority=-10 +event zeek_init() &priority=-10 { Intel::insert([$indicator="10.0.0.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]); Intel::insert([$indicator="10.0.0.2", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]); schedule 1sec { do_it() }; - } \ No newline at end of file + } diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/certs.zeek b/testing/btest/scripts/policy/frameworks/intel/seen/certs.zeek index 8571784d9a..c90c5e41f4 100644 --- a/testing/btest/scripts/policy/frameworks/intel/seen/certs.zeek +++ b/testing/btest/scripts/policy/frameworks/intel/seen/certs.zeek @@ -17,7 +17,7 @@ www.dresdner-privat.de Intel::DOMAIN source1 test entry http://some-data-distrib redef Intel::read_files += { "intel.dat" }; -event bro_init() +event zeek_init() { suspend_processing(); } diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/smb.zeek b/testing/btest/scripts/policy/frameworks/intel/seen/smb.zeek index 5dd594953b..5e0024ec7c 100644 --- a/testing/btest/scripts/policy/frameworks/intel/seen/smb.zeek +++ b/testing/btest/scripts/policy/frameworks/intel/seen/smb.zeek @@ -11,7 +11,7 @@ pythonfile Intel::FILE_NAME source1 test entry http://some-data-distributor.com/ redef Intel::read_files += { "intel.dat" }; -event bro_init() +event zeek_init() { suspend_processing(); } diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/smtp.zeek b/testing/btest/scripts/policy/frameworks/intel/seen/smtp.zeek index fd21e0f73a..6ad04e95bd 100644 --- a/testing/btest/scripts/policy/frameworks/intel/seen/smtp.zeek +++ b/testing/btest/scripts/policy/frameworks/intel/seen/smtp.zeek @@ -16,7 +16,7 @@ name-addr@example.com Intel::EMAIL source1 test entry http://some-data-distribut redef Intel::read_files += { "intel.dat" }; -event bro_init() +event zeek_init() { suspend_processing(); } diff --git a/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek b/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek index 53acd49aa9..560ba35c0a 100644 --- a/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek +++ b/testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek @@ -23,7 +23,7 @@ redef Intel::read_files += { global total_files_read = 0; -event bro_init() +event zeek_init() { suspend_processing(); } diff --git a/testing/btest/scripts/policy/frameworks/software/version-changes.zeek b/testing/btest/scripts/policy/frameworks/software/version-changes.zeek index c6d2433236..493bc1d354 100644 --- a/testing/btest/scripts/policy/frameworks/software/version-changes.zeek +++ b/testing/btest/scripts/policy/frameworks/software/version-changes.zeek @@ -34,7 +34,7 @@ event new_software() event new_software(); } -event bro_init() +event zeek_init() { event new_software(); } diff --git a/testing/btest/scripts/policy/frameworks/software/vulnerable.zeek b/testing/btest/scripts/policy/frameworks/software/vulnerable.zeek index 2ea7009a21..dd233a6ffc 100644 --- a/testing/btest/scripts/policy/frameworks/software/vulnerable.zeek +++ b/testing/btest/scripts/policy/frameworks/software/vulnerable.zeek @@ -11,7 +11,7 @@ redef Software::vulnerable_versions += { ["Java"] = set(java_1_6_vuln, java_1_7_vuln) }; -event bro_init() +event zeek_init() { Software::found([$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=4.3.2.1, $resp_p=80/tcp], [$name="Java", $host=1.2.3.4, $version=[$major=1, $minor=7, $minor2=0, $minor3=15]]); diff --git a/testing/btest/scripts/policy/misc/weird-stats.zeek b/testing/btest/scripts/policy/misc/weird-stats.zeek index d5b83e3c05..16a0ca02d7 100644 --- a/testing/btest/scripts/policy/misc/weird-stats.zeek +++ b/testing/btest/scripts/policy/misc/weird-stats.zeek @@ -24,7 +24,7 @@ event gen_weirds(n: count, done: bool &default = F) schedule 5sec { die() }; } -event bro_init() +event zeek_init() { event gen_weirds(1000); schedule 7.5sec { gen_weirds(2000) } ; diff --git a/testing/btest/scripts/policy/protocols/http/test-sql-injection-regex.zeek b/testing/btest/scripts/policy/protocols/http/test-sql-injection-regex.zeek index 2e82eb9dfb..3041abab75 100644 --- a/testing/btest/scripts/policy/protocols/http/test-sql-injection-regex.zeek +++ b/testing/btest/scripts/policy/protocols/http/test-sql-injection-regex.zeek @@ -3,8 +3,8 @@ @load protocols/http/detect-sqli -event bro_init () -{ +event zeek_init() + { local positive_matches: set[string]; local negative_matches: set[string]; diff --git a/testing/btest/signatures/dpd.zeek b/testing/btest/signatures/dpd.zeek index 39f1b01294..b6d58fb3a3 100644 --- a/testing/btest/signatures/dpd.zeek +++ b/testing/btest/signatures/dpd.zeek @@ -30,7 +30,7 @@ signature my_ftp_server { @load base/utils/addrs -event bro_init() +event zeek_init() { # no analyzer attached to any port by default, depends entirely on sigs print "|Analyzer::all_registered_ports()|", |Analyzer::all_registered_ports()|; diff --git a/testing/scripts/file-analysis-test.zeek b/testing/scripts/file-analysis-test.zeek index aa7d158b55..337bf3c1c0 100644 --- a/testing/scripts/file-analysis-test.zeek +++ b/testing/scripts/file-analysis-test.zeek @@ -108,7 +108,7 @@ event file_state_remove(f: fa_file) print fmt("SHA256: %s", f$info$sha256); } -event bro_init() +event zeek_init() { add test_file_analyzers[Files::ANALYZER_MD5]; add test_file_analyzers[Files::ANALYZER_SHA1];