Merge remote-tracking branch 'origin/topic/seth/zeek_init'

* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.

CHANGES

@@ -1,4 +1,12 @@
 
+2.6-236 | 2019-04-19 11:16:35 -0700
+
+  * Add zeek_init/zeek_done events and deprecate bro_init/bro_done (Seth Hall, Corelight)
+
+    Any existing handlers for bro_init and bro_done will automatically alias
+    to the new zeek_init and zeek_done events such that code will not break,
+    but will emit a deprecation warning.
+
 2.6-232 | 2019-04-18 09:34:13 +0200
 
   * Prevent topk_merge from crashing when second argument is empty set (Jeff Barber)

NEWS

@@ -176,6 +176,12 @@ Deprecated Functionality
   instead.  The later will automatically return a value that is enclosed
   in double-quotes.
 
+- The ``bro_init`` and ``bro_done`` events are now deprecated, use
+  ``zeek_init`` and ``zeek_done`` instead.  Any existing handlers for
+  ``bro_init`` and ``bro_done`` will automatically alias to the new
+  ``zeek_init`` and ``zeek_done`` events such that existing code will
+  not break, but will emit a deprecation warning.
+
 Bro 2.6
 =======
 

VERSION

@@ -1 +1 @@
-2.6-232
+2.6-236

aux/broctl

@@ -1 +1 @@
-Subproject commit 65f213ff3573314ac8f7b33ff4b121d93fc883dc
+Subproject commit 5698525ae41c397c18eba1d5350cca18fa081665

aux/broker

@@ -1 +1 @@
-Subproject commit e8f6d7fa952c7d0bb9cb5f54e82806a17a9b85f3
+Subproject commit 1ab04b7bd893f65c1339b2ac92596dca6ed66412

doc

@@ -1 +1 @@
-Subproject commit 9b556e5e71d0d8a5c2e7a1d4be4b308d887310f1
+Subproject commit 5e02a297eefe8740e8b84f7610fbf126af5c3475

scripts/base/files/extract/main.zeek

@@ -75,7 +75,7 @@ event file_extraction_limit(f: fa_file, args: Files::AnalyzerArgs, limit: count,
 	f$info$extracted_size = limit;
 	}
 
-event bro_init() &priority=10
+event zeek_init() &priority=10
 	{
 	Files::register_analyzer_add_callback(Files::ANALYZER_EXTRACT, on_add);
 	}

scripts/base/files/pe/main.zeek

@@ -55,7 +55,7 @@ redef record fa_file += {
 
 const pe_mime_types = { "application/x-dosexec" };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_for_mime_types(Files::ANALYZER_PE, pe_mime_types);
 	Log::create_stream(LOG, [$columns=Info, $ev=log_pe, $path="pe"]);

scripts/base/files/unified2/main.zeek

@@ -193,7 +193,7 @@ event Input::end_of_data(name: string, source: string)
 		start_watching();
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Unified2::LOG, [$columns=Info, $ev=log_unified2, $path="unified2"]);
 

scripts/base/files/x509/main.zeek

@@ -29,7 +29,7 @@ export {
 	global log_x509: event(rec: Info);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(X509::LOG, [$columns=Info, $ev=log_x509, $path="x509"]);
 

scripts/base/frameworks/analyzer/main.zeek

@@ -135,7 +135,7 @@ export {
 
 global ports: table[Analyzer::Tag] of set[port];
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	if ( disable_all )
 		__disable_all_analyzers();

scripts/base/frameworks/broker/log.zeek

@@ -30,7 +30,7 @@ export {
 	};
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Broker::LOG, [$columns=Info, $path="broker"]);
 	}

scripts/base/frameworks/broker/main.zeek

@@ -298,7 +298,7 @@ export {
 
 	## Register interest in all peer event messages that use a certain topic
 	## prefix.  Note that subscriptions may not be altered immediately after
-	## calling (except during :bro:see:`bro_init`).
+	## calling (except during :bro:see:`zeek_init`).
 	##
 	## topic_prefix: a prefix to match against remote message topics.
 	##               e.g. an empty prefix matches everything and "a" matches
@@ -309,7 +309,7 @@ export {
 
 	## Unregister interest in all peer event messages that use a topic prefix.
 	## Note that subscriptions may not be altered immediately after calling
-	## (except during :bro:see:`bro_init`).
+	## (except during :bro:see:`zeek_init`).
 	##
 	## topic_prefix: a prefix previously supplied to a successful call to
 	##               :bro:see:`Broker::subscribe` or :bro:see:`Broker::forward`.

scripts/base/frameworks/cluster/main.zeek

@@ -359,7 +359,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string) &priority=1
 		}
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	# If a node is given, but it's an unknown name we need to fail.
 	if ( node != "" && node !in nodes )

scripts/base/frameworks/cluster/pools.zeek

@@ -324,7 +324,7 @@ function mark_pool_node_dead(pool: Pool, name: string): bool
 	return T;
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	worker_pool = register_pool(worker_pool_spec);
 	proxy_pool = register_pool(proxy_pool_spec);
@@ -344,8 +344,8 @@ function pool_sorter(a: Pool, b: Pool): int
 	return strcmp(a$spec$topic, b$spec$topic);
 	}
 
-# Needs to execute before the bro_init in setup-connections
+# Needs to execute before the zeek_init in setup-connections
-event bro_init() &priority=-5
+event zeek_init() &priority=-5
 	{
 	if ( ! Cluster::is_enabled() )
 		return;

scripts/base/frameworks/cluster/setup-connections.zeek

@@ -42,7 +42,7 @@ function connect_peers_with_type(node_type: NodeType)
 		}
 	}
 
-event bro_init() &priority=-10
+event zeek_init() &priority=-10
 	{
 	if ( getenv("BROCTL_CHECK_CONFIG") != "" )
 		return;

scripts/base/frameworks/config/input.zeek

@@ -34,7 +34,7 @@ event config_line(description: Input::EventDescription, tpe: Input::Event, p: Ev
 	{
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	if ( Cluster::is_enabled() && Cluster::local_node_type() != Cluster::MANAGER )
 		return;

scripts/base/frameworks/config/main.zeek

@@ -150,7 +150,7 @@ function config_option_changed(ID: string, new_value: any, location: string): an
 	return new_value;
 	}
 
-event bro_init() &priority=10
+event zeek_init() &priority=10
 	{
 	Log::create_stream(LOG, [$columns=Info, $ev=log_config, $path="config"]);
 

scripts/base/frameworks/config/weird.zeek

@@ -35,7 +35,7 @@ function weird_option_change_interval(ID: string, new_value: interval, location:
 	return new_value;
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Option::set_change_handler("Weird::sampling_whitelist", weird_option_change_sampling_whitelist, 5);
 	Option::set_change_handler("Weird::sampling_threshold", weird_option_change_count, 5);

scripts/base/frameworks/dpd/main.zeek

@@ -39,7 +39,7 @@ redef record connection += {
 	dpd: Info &optional;
 };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(DPD::LOG, [$columns=Info, $path="dpd"]);
 	}

scripts/base/frameworks/files/main.zeek

@@ -324,7 +324,7 @@ global mime_type_to_analyzers: table[string] of set[Files::Tag];
 
 global analyzer_add_callbacks: table[Files::Tag] of function(f: fa_file, args: AnalyzerArgs) = table();
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Files::LOG, [$columns=Info, $ev=log_files, $path="files"]);
 	}

scripts/base/frameworks/intel/cluster.zeek

@@ -16,7 +16,7 @@ redef have_full_data = F;
 @endif
 
 @if ( Cluster::local_node_type() == Cluster::MANAGER )
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::worker_topic, remove_indicator);
 	}
@@ -67,7 +67,7 @@ event Intel::match_remote(s: Seen) &priority=5
 @endif
 
 @if ( Cluster::local_node_type() == Cluster::WORKER )
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::manager_topic, match_remote);
 	Broker::auto_publish(Cluster::manager_topic, remove_item);

scripts/base/frameworks/intel/input.zeek

@@ -27,7 +27,7 @@ event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item:
 	Intel::insert(item);
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	if ( ! Cluster::is_enabled() ||
 	     Cluster::local_node_type() == Cluster::MANAGER )

scripts/base/frameworks/intel/main.zeek

@@ -223,7 +223,7 @@ type MinDataStore: record {
 global min_data_store: MinDataStore &redef;
 
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(LOG, [$columns=Info, $ev=log_intel, $path="intel"]);
 	}

scripts/base/frameworks/logging/postprocessors/scp.zeek

@@ -2,7 +2,7 @@
 ##! to a logging filter in order to automatically SCP (secure copy)
 ##! a log stream (or a subset of it) to a remote host at configurable
 ##! rotation time intervals.  Generally, to use this functionality
-##! you must handle the :bro:id:`bro_init` event and do the following
+##! you must handle the :bro:id:`zeek_init` event and do the following
 ##! in your handler:
 ##!
 ##! 1) Create a new :bro:type:`Log::Filter` record that defines a name/path,

scripts/base/frameworks/logging/postprocessors/sftp.zeek

@@ -2,7 +2,7 @@
 ##! to a logging filter in order to automatically SFTP
 ##! a log stream (or a subset of it) to a remote host at configurable
 ##! rotation time intervals.  Generally, to use this functionality
-##! you must handle the :bro:id:`bro_init` event and do the following
+##! you must handle the :bro:id:`zeek_init` event and do the following
 ##! in your handler:
 ##!
 ##! 1) Create a new :bro:type:`Log::Filter` record that defines a name/path,

scripts/base/frameworks/netcontrol/catch-and-release.zeek

@@ -163,7 +163,7 @@ export {
 # Set that is used to only send seen notifications to the master every ~30 seconds.
 global catch_release_recently_notified: set[addr] &create_expire=30secs;
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(NetControl::CATCH_RELEASE, [$columns=CatchReleaseInfo, $ev=log_netcontrol_catch_release, $path="netcontrol_catch_release"]);
 	}
@@ -227,13 +227,13 @@ global blocks: table[addr] of BlockInfo = {}
 @if ( Cluster::is_enabled() )
 
 @if ( Cluster::local_node_type() == Cluster::MANAGER )
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::worker_topic, NetControl::catch_release_block_new);
 	Broker::auto_publish(Cluster::worker_topic, NetControl::catch_release_block_delete);
 	}
 @else
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::manager_topic, NetControl::catch_release_add);
 	Broker::auto_publish(Cluster::manager_topic, NetControl::catch_release_delete);

scripts/base/frameworks/netcontrol/cluster.zeek

@@ -17,7 +17,7 @@ export {
 }
 
 @if ( Cluster::local_node_type() == Cluster::MANAGER )
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::worker_topic, NetControl::rule_added);
 	Broker::auto_publish(Cluster::worker_topic, NetControl::rule_removed);
@@ -28,7 +28,7 @@ event bro_init()
 	Broker::auto_publish(Cluster::worker_topic, NetControl::rule_destroyed);
 	}
 @else
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::manager_topic, NetControl::cluster_netcontrol_add_rule);
 	Broker::auto_publish(Cluster::manager_topic, NetControl::cluster_netcontrol_remove_rule);

scripts/base/frameworks/netcontrol/drop.zeek

@@ -55,7 +55,7 @@ export {
 	global log_netcontrol_drop: event(rec: DropInfo);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(NetControl::DROP, [$columns=DropInfo, $ev=log_netcontrol_drop, $path="netcontrol_drop"]);
 	}

scripts/base/frameworks/netcontrol/main.zeek

@@ -262,7 +262,7 @@ export {
 	##### Plugin functions
 
 	## Function called by plugins once they finished their activation. After all
-	## plugins defined in bro_init finished to activate, rules will start to be sent
+	## plugins defined in zeek_init finished to activate, rules will start to be sent
 	## to the plugins. Rules that scripts try to set before the backends are ready
 	## will be discarded.
 	global plugin_activated: function(p: PluginState);
@@ -338,13 +338,13 @@ redef record Rule += {
 };
 
 # Variable tracking the state of plugin activation. Once all plugins that
-# have been added in bro_init are activated, this will switch to T and
+# have been added in zeek_init are activated, this will switch to T and
 # the event NetControl::init_done will be raised.
 global plugins_active: bool = F;
 
-# Set to true at the end of bro_init (with very low priority).
+# Set to true at the end of zeek_init (with very low priority).
 # Used to track when plugin activation could potentially be finished
-global bro_init_done: bool = F;
+global zeek_init_done: bool = F;
 
 # The counters that are used to generate the rule and plugin IDs
 global rule_counter: count = 1;
@@ -364,7 +364,7 @@ global rules_by_subnets: table[subnet] of set[string];
 # There always only can be one rule of each type for one entity.
 global rule_entities: table[Entity, RuleType] of Rule;
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(NetControl::LOG, [$columns=Info, $ev=log_netcontrol, $path="netcontrol"]);
 	}
@@ -613,18 +613,18 @@ function plugin_activated(p: PluginState)
 	plugin_ids[id]$_activated = T;
 	log_msg("activation finished", p);
 
-	if ( bro_init_done )
+	if ( zeek_init_done )
 		check_plugins();
 	}
 
-event bro_init() &priority=-5
+event zeek_init() &priority=-5
 	{
 	event NetControl::init();
 	}
 
 event NetControl::init() &priority=-20
 	{
-	bro_init_done = T;
+	zeek_init_done = T;
 
 	check_plugins();
 

scripts/base/frameworks/netcontrol/shunt.zeek

@@ -36,7 +36,7 @@ export {
 	global log_netcontrol_shunt: event(rec: ShuntInfo);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(NetControl::SHUNT, [$columns=ShuntInfo, $ev=log_netcontrol_shunt, $path="netcontrol_shunt"]);
 	}

scripts/base/frameworks/notice/actions/pp-alarms.zeek

@@ -95,7 +95,7 @@ function pp_postprocessor(info: Log::RotationInfo): bool
 	return T;
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	if ( ! want_pp() )
 		return;

scripts/base/frameworks/notice/main.zeek

@@ -385,7 +385,7 @@ function log_mailing_postprocessor(info: Log::RotationInfo): bool
 	return T;
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice, $path="notice"]);
 
@@ -531,7 +531,7 @@ event Notice::begin_suppression(ts: time, suppress_for: interval, note: Type,
 	suppressing[note, identifier] = suppress_until;
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	if ( ! Cluster::is_enabled() )
 		return;

scripts/base/frameworks/notice/weird.zeek

@@ -296,7 +296,7 @@ const notice_actions = {
 	ACTION_NOTICE_ONCE,
 };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Weird::LOG, [$columns=Info, $ev=log_weird, $path="weird"]);
 	}

scripts/base/frameworks/openflow/cluster.zeek

@@ -15,7 +15,7 @@ export {
 
 @if ( Cluster::local_node_type() != Cluster::MANAGER )
 # Workers need ability to forward commands to manager.
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::manager_topic, OpenFlow::cluster_flow_mod);
 	Broker::auto_publish(Cluster::manager_topic, OpenFlow::cluster_flow_clear);

scripts/base/frameworks/openflow/plugins/log.zeek

@@ -46,7 +46,7 @@ export {
 	global log_openflow: event(rec: Info);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(OpenFlow::LOG, [$columns=Info, $ev=log_openflow, $path="openflow"]);
 	}

scripts/base/frameworks/packet-filter/main.zeek

@@ -157,7 +157,7 @@ event filter_change_tracking()
 	schedule 5min { filter_change_tracking() };
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(PacketFilter::LOG, [$columns=Info, $path="packet_filter"]);
 
@@ -175,7 +175,7 @@ event bro_init() &priority=5
 		}
 	}
 
-event bro_init() &priority=-5
+event zeek_init() &priority=-5
 	{
 	install();
 

scripts/base/frameworks/packet-filter/netstats.zeek

@@ -33,7 +33,7 @@ event net_stats_update(last_stat: NetStats)
 	schedule stats_collection_interval { net_stats_update(ns) };
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	# Since this currently only calculates packet drops, let's skip the stats
 	# collection if reading traces.

scripts/base/frameworks/reporter/main.zeek

@@ -35,7 +35,7 @@ export {
 	};
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Reporter::LOG, [$columns=Info, $path="reporter"]);
 	}

scripts/base/frameworks/signatures/main.zeek

@@ -140,7 +140,7 @@ global count_per_orig: table[addr, string] of count
 global did_sig_log: set[string] &read_expire = 1 hr;
 
 
-event bro_init()
+event zeek_init()
 	{
 	Log::create_stream(Signatures::LOG, [$columns=Info, $ev=log_signature, $path="signatures"]);
 	}

scripts/base/frameworks/software/main.zeek

@@ -121,7 +121,7 @@ export {
 	global register: event(info: Info);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Software::LOG, [$columns=Info, $ev=log_software, $path="software"]);
 	}

scripts/base/frameworks/sumstats/cluster.zeek

@@ -61,7 +61,7 @@ global recent_global_view_keys: set[string, Key] &create_expire=1min;
 
 @if ( Cluster::local_node_type() != Cluster::MANAGER )
 
-event bro_init() &priority=100
+event zeek_init() &priority=100
 	{
 	Broker::auto_publish(Cluster::manager_topic, SumStats::cluster_send_result);
 	Broker::auto_publish(Cluster::manager_topic, SumStats::cluster_key_intermediate_response);
@@ -209,7 +209,7 @@ function request_key(ss_name: string, key: Key): Result
 
 @if ( Cluster::local_node_type() == Cluster::MANAGER )
 
-event bro_init() &priority=100
+event zeek_init() &priority=100
 	{
 	Broker::auto_publish(Cluster::worker_topic, SumStats::cluster_ss_request);
 	Broker::auto_publish(Cluster::worker_topic, SumStats::cluster_get_result);

scripts/base/frameworks/sumstats/main.zeek

@@ -270,7 +270,7 @@ function add_observe_plugin_dependency(calc: Calculation, depends_on: Calculatio
 	calc_deps[calc] += depends_on;
 	}
 
-event bro_init() &priority=100000
+event zeek_init() &priority=100000
 	{
 	# Call all of the plugin registration hooks
 	hook register_observe_plugins();

scripts/base/frameworks/tunnels/main.zeek

@@ -87,7 +87,7 @@ const teredo_ports = { 3544/udp };
 const gtpv1_ports = { 2152/udp, 2123/udp };
 redef likely_server_ports += { ayiya_ports, teredo_ports, gtpv1_ports, vxlan_ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Tunnel::LOG, [$columns=Info, $path="tunnel"]);
 

scripts/base/misc/find-checksum-offloading.zeek

@@ -62,7 +62,7 @@ event ChecksumOffloading::check()
 		}
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	schedule check_interval { ChecksumOffloading::check() };
 	}
@@ -81,7 +81,7 @@ event conn_weird(name: string, c: connection, addl: string)
 		++bad_udp_checksums;
 	}
 
-event bro_done()
+event zeek_done()
 	{
 	event ChecksumOffloading::check();
 	}

scripts/base/misc/find-filtered-trace.zeek

@@ -36,7 +36,7 @@ event connection_state_remove(c: connection)
 		saw_tcp_conn_with_data = T;
 	}
 
-event bro_done()
+event zeek_done()
 	{
 	if ( ! enable )
 		return;

scripts/base/protocols/conn/main.zeek

@@ -155,7 +155,7 @@ redef record connection += {
 	conn: Info &optional;
 };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Conn::LOG, [$columns=Info, $ev=log_conn, $path="conn"]);
 	}

scripts/base/protocols/dce-rpc/main.zeek

@@ -59,7 +59,7 @@ redef record connection += {
 const ports = { 135/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(DCE_RPC::LOG, [$columns=Info, $path="dce_rpc"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_DCE_RPC, ports);

scripts/base/protocols/dhcp/main.zeek

@@ -117,14 +117,14 @@ redef record Info += {
 const ports = { 67/udp, 68/udp, 4011/udp };
 redef likely_server_ports += { 67/udp };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(DHCP::LOG, [$columns=Info, $ev=log_dhcp, $path="dhcp"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_DHCP, ports);
 	}
 
 @if ( Cluster::is_enabled() )
-event bro_init()
+event zeek_init()
 	{
 	Broker::auto_publish(Cluster::manager_topic, DHCP::aggregate_msgs);
 	}
@@ -264,7 +264,7 @@ event dhcp_message(c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP::
 	event DHCP::aggregate_msgs(network_time(), c$id, c$uid, is_orig, msg, options);
 	}
 
-event bro_done() &priority=-5
+event zeek_done() &priority=-5
 	{
 	# Log any remaining data that hasn't already been logged!
 	for ( i in DHCP::join_data )

scripts/base/protocols/dnp3/main.zeek

@@ -34,7 +34,7 @@ redef record connection += {
 const ports = { 20000/tcp , 20000/udp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(DNP3::LOG, [$columns=Info, $ev=log_dnp3, $path="dnp3"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_DNP3_TCP, ports);

scripts/base/protocols/dns/main.zeek

@@ -154,7 +154,7 @@ redef record connection += {
 const ports = { 53/udp, 53/tcp, 137/udp, 5353/udp, 5355/udp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(DNS::LOG, [$columns=Info, $ev=log_dns, $path="dns"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_DNS, ports);

scripts/base/protocols/ftp/files.zeek

@@ -45,7 +45,7 @@ function describe_file(f: fa_file): string
 	return "";
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_protocol(Analyzer::ANALYZER_FTP_DATA,
 	                         [$get_file_handle = FTP::get_file_handle,

scripts/base/protocols/ftp/main.zeek

@@ -50,7 +50,7 @@ redef record connection += {
 const ports = { 21/tcp, 2811/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(FTP::LOG, [$columns=Info, $ev=log_ftp, $path="ftp"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_FTP, ports);

scripts/base/protocols/http/files.zeek

@@ -48,7 +48,7 @@ function describe_file(f: fa_file): string
 	return "";
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_protocol(Analyzer::ANALYZER_HTTP,
 	                         [$get_file_handle = HTTP::get_file_handle,

scripts/base/protocols/http/main.zeek

@@ -139,7 +139,7 @@ const ports = {
 redef likely_server_ports += { ports };
 
 # Initialize the HTTP logging stream and ports.
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(HTTP::LOG, [$columns=Info, $ev=log_http, $path="http"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_HTTP, ports);

scripts/base/protocols/imap/main.zeek

@@ -4,7 +4,7 @@ module IMAP;
 const ports = { 143/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Analyzer::register_for_ports(Analyzer::ANALYZER_IMAP, ports);
 	}

scripts/base/protocols/irc/files.zeek

@@ -23,7 +23,7 @@ function get_file_handle(c: connection, is_orig: bool): string
 	return cat(Analyzer::ANALYZER_IRC_DATA, c$start_time, c$id, is_orig);
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_protocol(Analyzer::ANALYZER_IRC_DATA,
 	                         [$get_file_handle = IRC::get_file_handle]);

scripts/base/protocols/irc/main.zeek

@@ -41,7 +41,7 @@ redef record connection += {
 const ports = { 6666/tcp, 6667/tcp, 6668/tcp, 6669/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(IRC::LOG, [$columns=Info, $ev=irc_log, $path="irc"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_IRC, ports);

scripts/base/protocols/krb/files.zeek

@@ -61,7 +61,7 @@ function describe_file(f: fa_file): string
 			       f$info$x509$certificate$issuer);
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_protocol(Analyzer::ANALYZER_KRB_TCP,
 	                         [$get_file_handle = KRB::get_file_handle,

scripts/base/protocols/krb/main.zeek

@@ -73,7 +73,7 @@ const tcp_ports = { 88/tcp };
 const udp_ports = { 88/udp };
 redef likely_server_ports += { tcp_ports, udp_ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Analyzer::register_for_ports(Analyzer::ANALYZER_KRB, udp_ports);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_KRB_TCP, tcp_ports);

scripts/base/protocols/modbus/main.zeek

@@ -32,7 +32,7 @@ redef record connection += {
 const ports = { 502/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Modbus::LOG, [$columns=Info, $ev=log_modbus, $path="modbus"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_MODBUS, ports);

scripts/base/protocols/mysql/main.zeek

@@ -37,7 +37,7 @@ redef record connection += {
 
 const ports = { 1434/tcp, 3306/tcp };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(mysql::LOG, [$columns=Info, $ev=log_mysql, $path="mysql"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_MYSQL, ports);

scripts/base/protocols/ntlm/main.zeek

@@ -42,7 +42,7 @@ redef record connection += {
 	ntlm: Info &optional;
 };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(NTLM::LOG, [$columns=Info, $path="ntlm"]);
 	}

scripts/base/protocols/radius/main.zeek

@@ -56,7 +56,7 @@ redef record connection += {
 const ports = { 1812/udp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(RADIUS::LOG, [$columns=Info, $ev=log_radius, $path="radius"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_RADIUS, ports);

scripts/base/protocols/rdp/main.zeek

@@ -86,7 +86,7 @@ redef record connection += {
 const ports = { 3389/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(RDP::LOG, [$columns=RDP::Info, $ev=log_rdp, $path="rdp"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_RDP, ports);

scripts/base/protocols/rfb/main.zeek

@@ -76,7 +76,7 @@ redef record connection += {
 	rfb: Info &optional;
 };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(RFB::LOG, [$columns=Info, $ev=log_rfb, $path="rfb"]);
 	}

scripts/base/protocols/sip/main.zeek

@@ -98,7 +98,7 @@ redef record connection += {
 const ports = { 5060/udp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(SIP::LOG, [$columns=Info, $ev=log_sip, $path="sip"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_SIP, ports);

scripts/base/protocols/smb/files.zeek

@@ -46,7 +46,7 @@ function describe_file(f: fa_file): string
 	return "";
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_protocol(Analyzer::ANALYZER_SMB,
 	                         [$get_file_handle = SMB::get_file_handle,

scripts/base/protocols/smb/main.zeek

@@ -177,7 +177,7 @@ redef record FileInfo += {
 const ports = { 139/tcp, 445/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(SMB::FILES_LOG, [$columns=SMB::FileInfo, $path="smb_files"]);
 	Log::create_stream(SMB::MAPPING_LOG, [$columns=SMB::TreeInfo, $path="smb_mapping"]);

scripts/base/protocols/smtp/files.zeek

@@ -38,7 +38,7 @@ function describe_file(f: fa_file): string
 	return "";
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_protocol(Analyzer::ANALYZER_SMTP,
 	                         [$get_file_handle = SMTP::get_file_handle,

scripts/base/protocols/smtp/main.zeek

@@ -92,7 +92,7 @@ redef record connection += {
 const ports = { 25/tcp, 587/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(SMTP::LOG, [$columns=SMTP::Info, $ev=log_smtp, $path="smtp"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_SMTP, ports);

scripts/base/protocols/snmp/main.zeek

@@ -63,7 +63,7 @@ redef record connection += {
 const ports = { 161/udp, 162/udp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Analyzer::register_for_ports(Analyzer::ANALYZER_SNMP, ports);
 	Log::create_stream(SNMP::LOG, [$columns=SNMP::Info, $ev=log_snmp, $path="snmp"]);

scripts/base/protocols/socks/main.zeek

@@ -47,7 +47,7 @@ export {
 const ports = { 1080/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(SOCKS::LOG, [$columns=Info, $ev=log_socks, $path="socks"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_SOCKS, ports);

scripts/base/protocols/ssh/main.zeek

@@ -136,7 +136,7 @@ redef record connection += {
 const ports = { 22/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Analyzer::register_for_ports(Analyzer::ANALYZER_SSH, ports);
 	Log::create_stream(SSH::LOG, [$columns=Info, $ev=log_ssh, $path="ssh"]);

scripts/base/protocols/ssl/files.zeek

@@ -79,7 +79,7 @@ function describe_file(f: fa_file): string
 		f$info$x509$certificate$issuer);
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Files::register_protocol(Analyzer::ANALYZER_SSL,
 	                         [$get_file_handle = SSL::get_file_handle,

scripts/base/protocols/ssl/main.zeek

@@ -137,7 +137,7 @@ const dtls_ports = { 443/udp };
 
 redef likely_server_ports += { ssl_ports, dtls_ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(SSL::LOG, [$columns=Info, $ev=log_ssl, $path="ssl"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, ssl_ports);

scripts/base/protocols/syslog/main.zeek

@@ -34,7 +34,7 @@ redef record connection += {
 const ports = { 514/udp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Syslog::LOG, [$columns=Info, $path="syslog"]);
 	Analyzer::register_for_ports(Analyzer::ANALYZER_SYSLOG, ports);

scripts/base/protocols/xmpp/main.zeek

@@ -4,7 +4,7 @@ module XMPP;
 const ports = { 5222/tcp, 5269/tcp };
 redef likely_server_ports += { ports };
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Analyzer::register_for_ports(Analyzer::ANALYZER_XMPP, ports);
 	}

scripts/base/utils/exec.zeek

@@ -186,7 +186,7 @@ function run(cmd: Command): Result
 		}
 	}
 
-event bro_done()
+event zeek_done()
 	{
 	# We are punting here and just deleting any unprocessed files.
 	for ( uid in pending_files )

scripts/base/utils/site.zeek

@@ -148,7 +148,7 @@ function get_emails(a: addr): string
 	return fmt_email_string(find_all_emails(a));
 	}
 
-event bro_init() &priority=10
+event zeek_init() &priority=10
 	{
 	# Double backslashes are needed due to string parsing.
 	local_dns_suffix_regex = set_to_regex(local_zones, "(^\\.?|\\.)(~~)$");

scripts/broxygen/__load__.zeek

@@ -11,7 +11,7 @@
 
 @load ./example.zeek
 
-event bro_init()
+event zeek_init()
 	{
 	terminate();
 	}

scripts/broxygen/example.zeek

@@ -189,6 +189,6 @@ type PrivateRecord: record {
 
 # Event handlers are also an implementation detail of a script, so they
 # don't show up anywhere in the generated documentation.
-event bro_init()
+event zeek_init()
     {
     }

scripts/policy/files/x509/log-ocsp.zeek

@@ -39,7 +39,7 @@ export {
 	global log_ocsp: event(rec: Info);
 }
 
-event bro_init()
+event zeek_init()
 	{
 	Log::create_stream(LOG, [$columns=Info, $ev=log_ocsp, $path="ocsp"]);
 	Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");

scripts/policy/frameworks/control/controllee.zeek

@@ -12,7 +12,7 @@
 
 module Control;
 
-event bro_init() &priority=-10
+event zeek_init() &priority=-10
 	{
 	Broker::subscribe(Control::topic_prefix + "/" + Broker::node_id());
 	Broker::auto_publish(Control::topic_prefix + "/id_value_response",

scripts/policy/frameworks/control/controller.zeek

@@ -12,7 +12,7 @@
 module Control;
 
 # Do some sanity checking and rework the communication nodes.
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	# We know that some command was given because this script wouldn't be
 	# loaded if there wasn't so we can feel free to throw an error here and

scripts/policy/frameworks/packet-filter/shunt.zeek

@@ -76,7 +76,7 @@ function shunt_filters()
 		PacketFilter::exclude("shunt_filters", filter);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	register_filter_plugin([
 		$func()={ return shunt_filters(); }

scripts/policy/frameworks/software/vulnerable.zeek

@@ -117,7 +117,7 @@ function update_vulnerable_sw()
 	event grab_vulnerable_versions(1);
 	}
 
-event bro_init() &priority=3
+event zeek_init() &priority=3
 	{
 	update_vulnerable_sw();
 	}

scripts/policy/integration/barnyard2/main.zeek

@@ -24,7 +24,7 @@ export {
 	global pid2cid: function(p: PacketID): conn_id;
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Barnyard2::LOG, [$columns=Info, $path="barnyard2"]);
 	}

scripts/policy/misc/capture-loss.zeek

@@ -74,7 +74,7 @@ event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps:
 	schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) };
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(LOG, [$columns=Info, $path="capture_loss"]);
 

scripts/policy/misc/detect-traceroute/main.zeek

@@ -53,7 +53,7 @@ export {
 	global log_traceroute: event(rec: Traceroute::Info);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Traceroute::LOG, [$columns=Info, $ev=log_traceroute, $path="traceroute"]);
 

scripts/policy/misc/load-balancing.zeek

@@ -28,7 +28,7 @@ export {
 
 @if ( Cluster::is_enabled() )
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	if ( method != AUTO_BPF )
 		return;

scripts/policy/misc/loaded-scripts.zeek

@@ -27,7 +27,7 @@ function get_indent(level: count): string
 	return out;
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(LoadedScripts::LOG, [$columns=Info, $path="loaded_scripts"]);
 	}

scripts/policy/misc/profiling.zeek

@@ -12,7 +12,7 @@ redef profiling_interval = 15 secs;
 ## :bro:id:`profiling_interval`).
 redef expensive_profiling_multiple = 20;
 
-event bro_init()
+event zeek_init()
 	{
 	set_buf(profiling_file, F);
 	}

scripts/policy/misc/scan.zeek

@@ -51,7 +51,7 @@ export {
 	global Scan::port_scan_policy: hook(scanner: addr, victim: addr, scanned_port: port);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	local r1: SumStats::Reducer = [$stream="scan.addr.fail", $apply=set(SumStats::UNIQUE), $unique_max=double_to_count(addr_scan_threshold+2)];
 	SumStats::create([$name="addr-scan",

scripts/policy/misc/stats.zeek

@@ -82,7 +82,7 @@ export {
 	global log_stats: event(rec: Info);
 }
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Stats::LOG, [$columns=Info, $ev=log_stats, $path="stats"]);
 	}
@@ -149,7 +149,7 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr
 	schedule report_interval { check_stats(nettime, ns, cs, ps, es, rs, ts, fs, ds) };
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	schedule report_interval { check_stats(network_time(), get_net_stats(), get_conn_stats(), get_proc_stats(), get_event_stats(), get_reassembler_stats(), get_timer_stats(), get_file_analysis_stats(), get_dns_stats()) };
 	}

scripts/policy/misc/trim-trace-file.zeek

@@ -30,7 +30,7 @@ event TrimTraceFile::go(first_trim: bool)
 	schedule trim_interval { TrimTraceFile::go(F) };
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	if ( trim_interval > 0 secs )
 		schedule trim_interval { TrimTraceFile::go(T) };

scripts/policy/misc/weird-stats.zeek

@@ -51,7 +51,7 @@ function weird_epoch_finished(ts: time)
 	this_epoch_weirds = table();
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(WeirdStats::LOG,
 	                   [$columns = Info, $ev = log_weird_stats,

scripts/policy/protocols/conn/known-hosts.zeek

@@ -61,7 +61,7 @@ export {
 	global log_known_hosts: event(rec: HostsInfo);
 }
 
-event bro_init()
+event zeek_init()
 	{
 	if ( ! Known::use_host_store )
 		return;
@@ -145,7 +145,7 @@ event Known::host_found(info: HostsInfo)
 	event known_host_add(info);
 	}
 
-event bro_init()
+event zeek_init()
 	{
 	Log::create_stream(Known::HOSTS_LOG, [$columns=HostsInfo, $ev=log_known_hosts, $path="known_hosts"]);
 	}

scripts/policy/protocols/conn/known-services.zeek

@@ -80,7 +80,7 @@ redef record connection += {
 };
 
 
-event bro_init()
+event zeek_init()
 	{
 	if ( ! Known::use_service_store )
 		return;
@@ -216,7 +216,7 @@ event connection_state_remove(c: connection) &priority=-5
 	known_services_done(c);
 	}
 
-event bro_init() &priority=5
+event zeek_init() &priority=5
 	{
 	Log::create_stream(Known::SERVICES_LOG, [$columns=ServicesInfo,
 	                                         $ev=log_known_services,

scripts/policy/protocols/ftp/detect-bruteforcing.zeek

@@ -25,7 +25,7 @@ export {
 }
 
 
-event bro_init()
+event zeek_init()
 	{
 	local r1: SumStats::Reducer = [$stream="ftp.failed_auth", $apply=set(SumStats::UNIQUE), $unique_max=double_to_count(bruteforce_threshold+2)];
 	SumStats::create([$name="ftp-detect-bruteforcing",