mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 10:38:20 +00:00
Merge remote-tracking branch 'origin/topic/bif_cleanup'
* origin/topic/bif_cleanup: Give mode2string a more generic name. Change some BiF return values from bool to any. Perform type checking on count-to-port conversion. Remove redundant connection_record() BiF. Remove redundant active_connection() BiF. Make exit() parameterizable. to_port() now parses a string instead of a count. Closes #684.
This commit is contained in:
commit
b649ade9ba
5 changed files with 312 additions and 294 deletions
21
CHANGES
21
CHANGES
|
@ -1,4 +1,25 @@
|
||||||
|
|
||||||
|
2.0-20 | 2012-01-25 16:34:51 -0800
|
||||||
|
|
||||||
|
* BiF cleanup (Matthias Vallentin)
|
||||||
|
|
||||||
|
- Rename NFS3::mode2string to a more generic file_mode().
|
||||||
|
|
||||||
|
- Unify do_profiling()/make_connection_persistent()/expect_connection()
|
||||||
|
to return any (i.e., nothing) instead of bools.
|
||||||
|
|
||||||
|
- Perform type checking on count-to-port conversion. Related to #684.
|
||||||
|
|
||||||
|
- Remove redundant connection_record() BiF. The same
|
||||||
|
functionality is provided by lookup_connection().
|
||||||
|
|
||||||
|
- Remove redundant active_connection() BiF. The same
|
||||||
|
functionality is provided by connection_exists().
|
||||||
|
|
||||||
|
- exit() now takes the exit code as argument.
|
||||||
|
|
||||||
|
- to_port() now received a string instead of a count.
|
||||||
|
|
||||||
2.0-9 | 2012-01-25 13:47:13 -0800
|
2.0-9 | 2012-01-25 13:47:13 -0800
|
||||||
|
|
||||||
* Allow local table variables to be initialized with {} list
|
* Allow local table variables to be initialized with {} list
|
||||||
|
|
2
VERSION
2
VERSION
|
@ -1 +1 @@
|
||||||
2.0-9
|
2.0-20
|
||||||
|
|
|
@ -103,7 +103,7 @@ event irc_dcc_message(c: connection, is_orig: bool,
|
||||||
return;
|
return;
|
||||||
c$irc$dcc_file_name = argument;
|
c$irc$dcc_file_name = argument;
|
||||||
c$irc$dcc_file_size = size;
|
c$irc$dcc_file_size = size;
|
||||||
local p = to_port(dest_port, tcp);
|
local p = count_to_port(dest_port, tcp);
|
||||||
expect_connection(to_addr("0.0.0.0"), address, p, ANALYZER_FILE, 5 min);
|
expect_connection(to_addr("0.0.0.0"), address, p, ANALYZER_FILE, 5 min);
|
||||||
dcc_expected_transfers[address, p] = c$irc;
|
dcc_expected_transfers[address, p] = c$irc;
|
||||||
}
|
}
|
||||||
|
|
87
src/bro.bif
87
src/bro.bif
|
@ -392,10 +392,12 @@ function setenv%(var: string, val: string%): bool
|
||||||
|
|
||||||
## Shuts down the Bro process immediately.
|
## Shuts down the Bro process immediately.
|
||||||
##
|
##
|
||||||
## .. todo: Change function signature to ``exit(code: int): any``.
|
## code: The exit code to return with.
|
||||||
function exit%(%): int
|
##
|
||||||
|
## .. bro:see:: terminate
|
||||||
|
function exit%(code: int%): any
|
||||||
%{
|
%{
|
||||||
exit(0);
|
exit(code);
|
||||||
return 0;
|
return 0;
|
||||||
%}
|
%}
|
||||||
|
|
||||||
|
@ -404,7 +406,7 @@ function exit%(%): int
|
||||||
## Returns: True after successful termination and false when Bro is still in
|
## Returns: True after successful termination and false when Bro is still in
|
||||||
## the process of shutting down.
|
## the process of shutting down.
|
||||||
##
|
##
|
||||||
## .. bro:see:: bro_is_terminating
|
## .. bro:see:: exit bro_is_terminating
|
||||||
function terminate%(%): bool
|
function terminate%(%): bool
|
||||||
%{
|
%{
|
||||||
if ( terminating )
|
if ( terminating )
|
||||||
|
@ -1942,12 +1944,12 @@ function record_fields%(rec: any%): record_field_table
|
||||||
## get_matcher_stats
|
## get_matcher_stats
|
||||||
## dump_rule_stats
|
## dump_rule_stats
|
||||||
## get_gap_summary
|
## get_gap_summary
|
||||||
function do_profiling%(%) : bool
|
function do_profiling%(%) : any
|
||||||
%{
|
%{
|
||||||
if ( profiling_logger )
|
if ( profiling_logger )
|
||||||
profiling_logger->Log();
|
profiling_logger->Log();
|
||||||
|
|
||||||
return new Val(1, TYPE_BOOL);
|
return 0;
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Checks whether a given IP address belongs to a local interface.
|
## Checks whether a given IP address belongs to a local interface.
|
||||||
|
@ -2215,14 +2217,16 @@ function port_to_count%(p: port%): count
|
||||||
|
|
||||||
## Converts a :bro:type:`count` and ``transport_proto`` to a :bro:type:`port`.
|
## Converts a :bro:type:`count` and ``transport_proto`` to a :bro:type:`port`.
|
||||||
##
|
##
|
||||||
## c: The :bro:type:`count` to convert.
|
## num: The :bro:type:`port` number.
|
||||||
|
##
|
||||||
|
## proto: The transport protocol.
|
||||||
##
|
##
|
||||||
## Returns: The :bro:type:`count` *c* as :bro:type:`port`.
|
## Returns: The :bro:type:`count` *c* as :bro:type:`port`.
|
||||||
##
|
##
|
||||||
## .. bro:see:: port_to_count
|
## .. bro:see:: port_to_count
|
||||||
function count_to_port%(c: count, t: transport_proto%): port
|
function count_to_port%(num: count, proto: transport_proto%): port
|
||||||
%{
|
%{
|
||||||
return new PortVal(c, (TransportProto)(t->InternalInt()));
|
return new PortVal(num, (TransportProto)proto->AsEnum());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Converts a :bro:type:`string` to an :bro:type:`addr`.
|
## Converts a :bro:type:`string` to an :bro:type:`addr`.
|
||||||
|
@ -2283,19 +2287,34 @@ function raw_bytes_to_v4_addr%(b: string%): addr
|
||||||
return new AddrVal(htonl(a));
|
return new AddrVal(htonl(a));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Creates a :bro:type:`port` from a given number and transport protocol.
|
## Converts a :bro:type:`string` to an :bro:type:`port`.
|
||||||
##
|
##
|
||||||
## num: The port number.
|
## s: The :bro:type:`string` to convert.
|
||||||
##
|
##
|
||||||
## proto: THe transport protocol of the port.
|
## Returns: A :bro:type:`port` converted from *s*.
|
||||||
##
|
|
||||||
## Returns: A :bro:type:`port` with number *num* and transport protocol
|
|
||||||
## *proto*.
|
|
||||||
##
|
##
|
||||||
## .. bro:see:: to_addr to_count to_int
|
## .. bro:see:: to_addr to_count to_int
|
||||||
function to_port%(num: count, proto: transport_proto%): port
|
function to_port%(s: string%): port
|
||||||
%{
|
%{
|
||||||
return new PortVal(num, (TransportProto)proto->AsEnum());
|
int port = 0;
|
||||||
|
if ( s->Len() < 10 )
|
||||||
|
{
|
||||||
|
char* slash;
|
||||||
|
port = strtol(s->CheckString(), &slash, 10);
|
||||||
|
if ( port )
|
||||||
|
{
|
||||||
|
++slash;
|
||||||
|
if ( streq(slash, "tcp") )
|
||||||
|
return new PortVal(port, TRANSPORT_TCP);
|
||||||
|
else if ( streq(slash, "udp") )
|
||||||
|
return new PortVal(port, TRANSPORT_UDP);
|
||||||
|
else if ( streq(slash, "icmp") )
|
||||||
|
return new PortVal(port, TRANSPORT_ICMP);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
builtin_error("wrong port format, must be /[0-9]{1,5}\\/(tcp|udp|icmp)/");
|
||||||
|
return new PortVal(port, TRANSPORT_UNKNOWN);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Converts a reverse pointer name to an address. For example,
|
## Converts a reverse pointer name to an address. For example,
|
||||||
|
@ -3741,7 +3760,7 @@ function x509_err2str%(err_num: count%): string
|
||||||
##
|
##
|
||||||
## Returns: A string representation of *mode* in the format
|
## Returns: A string representation of *mode* in the format
|
||||||
## ``rw[xsS]rw[xsS]rw[xtT]``.
|
## ``rw[xsS]rw[xsS]rw[xtT]``.
|
||||||
function NFS3::mode2string%(mode: count%): string
|
function file_mode%(mode: count%): string
|
||||||
%{
|
%{
|
||||||
char str[12];
|
char str[12];
|
||||||
char *p = str;
|
char *p = str;
|
||||||
|
@ -3857,11 +3876,11 @@ function NFS3::mode2string%(mode: count%): string
|
||||||
##
|
##
|
||||||
## .. todo:: The return value should be changed to any.
|
## .. todo:: The return value should be changed to any.
|
||||||
function expect_connection%(orig: addr, resp: addr, resp_p: port,
|
function expect_connection%(orig: addr, resp: addr, resp_p: port,
|
||||||
analyzer: count, tout: interval%) : bool
|
analyzer: count, tout: interval%) : any
|
||||||
%{
|
%{
|
||||||
dpm->ExpectConnection(orig, resp, resp_p->Port(), resp_p->PortType(),
|
dpm->ExpectConnection(orig, resp, resp_p->Port(), resp_p->PortType(),
|
||||||
(AnalyzerTag::Tag) analyzer, tout, 0);
|
(AnalyzerTag::Tag) analyzer, tout, 0);
|
||||||
return new Val(1, TYPE_BOOL);
|
return 0;
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Disables the analyzer which raised the current event (if the analyzer
|
## Disables the analyzer which raised the current event (if the analyzer
|
||||||
|
@ -5379,28 +5398,6 @@ function anonymize_addr%(a: addr, cl: IPAddrAnonymizationClass%): addr
|
||||||
#endif
|
#endif
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Deprecated. Will be removed.
|
|
||||||
function active_connection%(id: conn_id%): bool
|
|
||||||
%{
|
|
||||||
Connection* c = sessions->FindConnection(id);
|
|
||||||
return new Val(c ? 1 : 0, TYPE_BOOL);
|
|
||||||
%}
|
|
||||||
|
|
||||||
## Deprecated. Will be removed.
|
|
||||||
function connection_record%(cid: conn_id%): connection
|
|
||||||
%{
|
|
||||||
Connection* c = sessions->FindConnection(cid);
|
|
||||||
if ( c )
|
|
||||||
return c->BuildConnVal();
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// Hard to recover from this until we have union types ...
|
|
||||||
builtin_error("connection ID not a known connection (fatal)", cid);
|
|
||||||
exit(0);
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
%}
|
|
||||||
|
|
||||||
## Deprecated. Will be removed.
|
## Deprecated. Will be removed.
|
||||||
function dump_config%(%) : bool
|
function dump_config%(%) : bool
|
||||||
%{
|
%{
|
||||||
|
@ -5408,10 +5405,10 @@ function dump_config%(%) : bool
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Deprecated. Will be removed.
|
## Deprecated. Will be removed.
|
||||||
function make_connection_persistent%(c: connection%) : bool
|
function make_connection_persistent%(c: connection%) : any
|
||||||
%{
|
%{
|
||||||
c->MakePersistent();
|
c->MakePersistent();
|
||||||
return new Val(1, TYPE_BOOL);
|
return 0;
|
||||||
%}
|
%}
|
||||||
|
|
||||||
%%{
|
%%{
|
||||||
|
|
|
@ -2574,7 +2574,7 @@ event nfs_proc_null%(c: connection, info: NFS3::info_t%);
|
||||||
## .. bro:see:: nfs_proc_create nfs_proc_lookup nfs_proc_mkdir
|
## .. bro:see:: nfs_proc_create nfs_proc_lookup nfs_proc_mkdir
|
||||||
## nfs_proc_not_implemented nfs_proc_null nfs_proc_read nfs_proc_readdir
|
## nfs_proc_not_implemented nfs_proc_null nfs_proc_read nfs_proc_readdir
|
||||||
## nfs_proc_readlink nfs_proc_remove nfs_proc_rmdir nfs_proc_write nfs_reply_status
|
## nfs_proc_readlink nfs_proc_remove nfs_proc_rmdir nfs_proc_write nfs_reply_status
|
||||||
## rpc_call rpc_dialogue rpc_reply NFS3::mode2string
|
## rpc_call rpc_dialogue rpc_reply file_mode
|
||||||
##
|
##
|
||||||
## .. todo:: Bro's current default configuration does not activate the protocol
|
## .. todo:: Bro's current default configuration does not activate the protocol
|
||||||
## analyzer that generates this event; the corresponding script has not yet
|
## analyzer that generates this event; the corresponding script has not yet
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue