mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
Merge branch 'master' into topic/jsiwek/filter-rotation
This commit is contained in:
Jon Siwek
commit
d8c716ae17
46 changed files with 464 additions and 307 deletions
35
CHANGES
35
CHANGES
|
|
@ -1,4 +1,39 @@
|
|||
|
||||
1.6-dev-1221 | 2011-09-08 08:41:17 -0700
|
||||
|
||||
* Updates for documentation framework and script docs. (Jon Siwek)
|
||||
|
||||
* The script level PF_RING support isn't working so removing it.
|
||||
(Seth Hall)
|
||||
|
||||
* Delete SSL certificates from memory after ssl_established event.
|
||||
(Seth Hall)
|
||||
|
||||
* Small fixes for SSL analysis. (Seth Hall)
|
||||
|
||||
1.6-dev-1212 | 2011-09-07 16:15:28 -0700
|
||||
|
||||
* Internally, the UID generation can now return values from
|
||||
different pool for better reproducability in testing mode.
|
||||
(Gilbert Clark).
|
||||
|
||||
* Added new BiF unique_id_from(pool: string, prefix: string) that
|
||||
allows the user to specify a randomness pool. (Gilbert Clark)
|
||||
|
||||
1.6-dev-1198 | 2011-09-07 11:03:36 -0700
|
||||
|
||||
* Extended header for ASCII log that make it easier for scripts to
|
||||
parse Bro log files. (Gilbert Clark)
|
||||
|
||||
* Potential fix for rotation crashes. Addresses #588. (Robin Sommer)
|
||||
|
||||
* Added PF_RING load balancing support to the scripting layer,
|
||||
enabled by loading the misc/pf-ring-load-balancing script. (Seth
|
||||
Hall)
|
||||
|
||||
* Added a BiF setenv() for setting environment variables. (Seth
|
||||
Hall)
|
||||
|
||||
1.6-dev-1184 | 2011-09-04 09:34:50 -0700
|
||||
|
||||
* FindPCAP now links against thread library when necessary (e.g.
|
||||
|
|
|
|||
5
Makefile
5
Makefile
|
|
@ -13,15 +13,14 @@ all: configured
|
|||
install: configured
|
||||
( cd $(BUILD) && make install )
|
||||
|
||||
clean: configured
|
||||
clean: configured docclean
|
||||
( cd $(BUILD) && make clean )
|
||||
( cd $(BUILD) && make docclean && make restclean )
|
||||
|
||||
doc: configured
|
||||
( cd $(BUILD) && make doc )
|
||||
|
||||
docclean: configured
|
||||
( cd $(BUILD) && make docclean && make restclean )
|
||||
( cd $(BUILD) && make docclean )
|
||||
|
||||
dist:
|
||||
@./pkg/make-src-packages
|
||||
|
|
|
|||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
1.6-dev-1184
|
||||
1.6-dev-1221
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
Subproject commit 89c20c7f063afe5f39aa72bfec02d6996b291c13
|
||||
Subproject commit 89620cc8e500855fb763281000cbe2a24290a829
|
||||
|
|
@ -1 +1 @@
|
|||
Subproject commit 2b9053d40d7ef497c8cef6357b59f43129976d65
|
||||
Subproject commit c7499ee54f50bca65606dc3edc1aff132d93af80
|
||||
|
|
@ -1 +1,4 @@
|
|||
add_custom_target(doc)
|
||||
add_custom_target(docclean)
|
||||
|
||||
add_subdirectory(scripts)
|
||||
|
|
|
|||
|
|
@ -212,9 +212,9 @@ add_custom_target(restclean
|
|||
${RST_OUTPUT_DIR}
|
||||
VERBATIM)
|
||||
|
||||
# The "doc" target generates reST documentation for any outdated bro scripts
|
||||
# and then uses Sphinx to generate HTML documentation from the reST
|
||||
add_custom_target(doc
|
||||
# The "sphinxdoc" target generates reST documentation for any outdated bro
|
||||
# scripts and then uses Sphinx to generate HTML documentation from the reST
|
||||
add_custom_target(sphinxdoc
|
||||
# copy the template documentation to the build directory
|
||||
# to give as input for sphinx
|
||||
COMMAND "${CMAKE_COMMAND}" -E copy_directory
|
||||
|
|
@ -252,13 +252,16 @@ add_custom_target(doc
|
|||
# SOURCES just adds stuff to IDE projects as a convenience
|
||||
SOURCES ${DOC_SOURCES})
|
||||
|
||||
# The "docclean" target removes just the Sphinx input/output directories
|
||||
# The "sphinxclean" target removes just the Sphinx input/output directories
|
||||
# from the build directory.
|
||||
add_custom_target(docclean
|
||||
add_custom_target(sphinxclean
|
||||
COMMAND "${CMAKE_COMMAND}" -E remove_directory
|
||||
${DOC_SOURCE_WORKDIR}
|
||||
COMMAND "${CMAKE_COMMAND}" -E remove_directory
|
||||
${DOC_OUTPUT_DIR}
|
||||
VERBATIM)
|
||||
|
||||
add_dependencies(doc docclean restdoc)
|
||||
add_dependencies(sphinxdoc sphinxclean restdoc)
|
||||
|
||||
add_dependencies(doc sphinxdoc)
|
||||
add_dependencies(docclean sphinxclean restclean)
|
||||
|
|
|
|||
|
|
@ -16,13 +16,13 @@ rest_target(${CMAKE_CURRENT_SOURCE_DIR} example.bro internal)
|
|||
rest_target(${psd} base/init-default.bro internal)
|
||||
rest_target(${psd} base/init-bare.bro internal)
|
||||
|
||||
rest_target(${CMAKE_BINARY_DIR}/src/base bro.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src/base const.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src/base event.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src/base logging.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src/base reporter.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src/base strings.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src/base types.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src base/bro.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src base/const.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src base/event.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src base/logging.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src base/reporter.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src base/strings.bif.bro)
|
||||
rest_target(${CMAKE_BINARY_DIR}/src base/types.bif.bro)
|
||||
rest_target(${psd} base/frameworks/cluster/main.bro)
|
||||
rest_target(${psd} base/frameworks/cluster/nodes/manager.bro)
|
||||
rest_target(${psd} base/frameworks/cluster/nodes/proxy.bro)
|
||||
|
|
@ -33,6 +33,7 @@ rest_target(${psd} base/frameworks/control/main.bro)
|
|||
rest_target(${psd} base/frameworks/dpd/main.bro)
|
||||
rest_target(${psd} base/frameworks/intel/main.bro)
|
||||
rest_target(${psd} base/frameworks/logging/main.bro)
|
||||
rest_target(${psd} base/frameworks/logging/postprocessors/scp.bro)
|
||||
rest_target(${psd} base/frameworks/logging/writers/ascii.bro)
|
||||
rest_target(${psd} base/frameworks/metrics/cluster.bro)
|
||||
rest_target(${psd} base/frameworks/metrics/main.bro)
|
||||
|
|
@ -101,6 +102,7 @@ rest_target(${psd} policy/integration/barnyard2/main.bro)
|
|||
rest_target(${psd} policy/integration/barnyard2/types.bro)
|
||||
rest_target(${psd} policy/misc/analysis-groups.bro)
|
||||
rest_target(${psd} policy/misc/loaded-scripts.bro)
|
||||
rest_target(${psd} policy/misc/pf-ring-load-balancing.bro)
|
||||
rest_target(${psd} policy/misc/profiling.bro)
|
||||
rest_target(${psd} policy/misc/trim-trace-file.bro)
|
||||
rest_target(${psd} policy/protocols/conn/known-hosts.bro)
|
||||
|
|
|
|||
|
|
@ -5,20 +5,6 @@
|
|||
##! (reST) document's summary section.
|
||||
##!
|
||||
##! .. tip:: You can embed directives and roles within ``##``-stylized comments.
|
||||
##!
|
||||
##! A script's logging information has to be documented manually as minimally
|
||||
##! shown below. Note that references may not always be possible (e.g.
|
||||
##! anonymous filter functions) and a script may not need to document
|
||||
##! each of "columns", "event", "filter" depending on exactly what it's doing.
|
||||
##!
|
||||
##! **Logging Stream ID:** :bro:enum:`Example::EXAMPLE`
|
||||
##! :Columns: :bro:type:`Example::Info`
|
||||
##! :Event: :bro:id:`Example::log_example`
|
||||
##! :Filter: ``example-filter``
|
||||
##! uses :bro:id:`Example::filter_func` to determine whether to
|
||||
##! exclude the ``ts`` field
|
||||
##!
|
||||
##! :Author: Jon Siwek <jsiwek@ncsa.illinois.edu>
|
||||
|
||||
# Comments that use a single pound sign (#) are not significant to
|
||||
# a script's auto-generated documentation, but ones that use a
|
||||
|
|
|
|||
|
|
@ -73,7 +73,7 @@ bifs=`( cd ${sourcedir}/src && find . -name \*\.bif | sort )`
|
|||
for file in $bifs
|
||||
do
|
||||
f=${file:2}.bro
|
||||
echo "rest_target(\${CMAKE_BINARY_DIR}/src/base $f)" >> $outfile
|
||||
echo "rest_target(\${CMAKE_BINARY_DIR}/src base/$f)" >> $outfile
|
||||
done
|
||||
|
||||
scriptfiles=`( cd ${sourcedir}/scripts && find . -name \*\.bro | sort )`
|
||||
|
|
|
|||
|
|
@ -91,7 +91,7 @@ export {
|
|||
## If not given, all entries are recorded.
|
||||
##
|
||||
## rec: An instance of the streams's ``columns`` type with its
|
||||
## fields set to the values to logged.
|
||||
## fields set to the values to logged.
|
||||
##
|
||||
## Returns: True if the entry is to be recorded.
|
||||
pred: function(rec: any): bool &optional;
|
||||
|
|
|
|||
|
|
@ -1382,8 +1382,9 @@ const enable_syslog = F &redef;
|
|||
const peer_description = "bro" &redef;
|
||||
|
||||
## If true, broadcast events/state received from one peer to other peers.
|
||||
## NOTE: These options are only temporary. They will disappear when we get a
|
||||
## more sophisticated script-level communication framework.
|
||||
##
|
||||
## .. note:: These options are only temporary. They will disappear when we get
|
||||
## a more sophisticated script-level communication framework.
|
||||
const forward_remote_events = F &redef;
|
||||
## See :bro:id:`forward_remote_events`
|
||||
const forward_remote_state_changes = F &redef;
|
||||
|
|
@ -1513,6 +1514,6 @@ const skip_http_data = F &redef;
|
|||
## UDP tunnels. See also: udp_tunnel_port, policy/udp-tunnel.bro.
|
||||
const parse_udp_tunnels = F &redef;
|
||||
|
||||
## Load the logging framework here because it uses fairly deep integration with
|
||||
## BiFs and script-land defined types.
|
||||
# Load the logging framework here because it uses fairly deep integration with
|
||||
# BiFs and script-land defined types.
|
||||
@load base/frameworks/logging
|
||||
|
|
|
|||
|
|
@ -74,11 +74,11 @@ export {
|
|||
## This history is not meant to encode how much data that happened to be.
|
||||
history: string &log &optional;
|
||||
## Number of packets the originator sent.
|
||||
## Only set if :bro:id:`use_conn_size_analyzer`=T
|
||||
## Only set if :bro:id:`use_conn_size_analyzer` = T
|
||||
orig_pkts: count &log &optional;
|
||||
## Number IP level bytes the originator sent (as seen on the wire,
|
||||
## taken from IP total_length header field).
|
||||
## Only set if :bro:id:`use_conn_size_analyzer`=T
|
||||
## Only set if :bro:id:`use_conn_size_analyzer` = T
|
||||
orig_ip_bytes: count &log &optional;
|
||||
## Number of packets the responder sent. See ``orig_pkts``.
|
||||
resp_pkts: count &log &optional;
|
||||
|
|
|
|||
|
|
@ -29,6 +29,11 @@ export {
|
|||
## mozilla-ca-list.bro script it will be set to Mozilla's root CA list.
|
||||
const root_certs: table[string] of string = {} &redef;
|
||||
|
||||
## This determines if the c$ssl record is deleted after the record is
|
||||
## logged. You probably want this to be deleted since it contains
|
||||
## the full certificate and all of the chain certificates in it.
|
||||
const delete_certs_after_logging = T &redef;
|
||||
|
||||
global log_ssl: event(rec: Info);
|
||||
|
||||
const ports = {
|
||||
|
|
@ -113,10 +118,21 @@ event ssl_extension(c: connection, code: count, val: string) &priority=5
|
|||
c$ssl$server_name = sub_bytes(val, 6, |val|);
|
||||
}
|
||||
|
||||
event ssl_established(c: connection) &priority=-5
|
||||
event ssl_established(c: connection) &priority=5
|
||||
{
|
||||
set_session(c);
|
||||
|
||||
Log::write(SSL::LOG, c$ssl);
|
||||
}
|
||||
|
||||
event ssl_established(c: connection) &priority=-5
|
||||
{
|
||||
Log::write(SSL::LOG, c$ssl);
|
||||
|
||||
if ( delete_certs_after_logging )
|
||||
{
|
||||
if ( c$ssl?$cert )
|
||||
delete c$ssl$cert;
|
||||
if ( c$ssl?$cert_chain )
|
||||
delete c$ssl$cert_chain;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,22 +0,0 @@
|
|||
##! This script adds the necessary environment variables for Bro to make use
|
||||
##! of PF_RING's clustering (and load balancing) support through the libpcap
|
||||
##! wrapper.
|
||||
|
||||
module PFRing;
|
||||
|
||||
export {
|
||||
## Define the pf_ring cluster ID that you would like this instance
|
||||
## of Bro to use. Please set a value from 0 to 255
|
||||
const cluster_id = 150 &redef;
|
||||
}
|
||||
|
||||
|
||||
event bro_init() &priority=10
|
||||
{
|
||||
if ( cluster_id > 255 || cluster_id < 0 )
|
||||
Reporter::fatal(fmt("%d is an invalid value for PFRing::cluster_id", cluster_id));
|
||||
|
||||
if ( ! setenv("PCAP_PF_RING_USE_CLUSTER_PER_FLOW", "1") ||
|
||||
! setenv("PCAP_PF_RING_CLUSTER_ID", fmt("%d", cluster_id)) )
|
||||
Reporter::fatal("Unable to set one or both of the PF_RING environment variables.");
|
||||
}
|
||||
|
|
@ -14,7 +14,7 @@ export {
|
|||
|
||||
}
|
||||
|
||||
event ssl_established(c: connection) &priority=5
|
||||
event ssl_established(c: connection) &priority=3
|
||||
{
|
||||
# If there aren't any certs we can't very well do certificate validation.
|
||||
if ( !c$ssl?$cert || !c$ssl?$cert_chain )
|
||||
|
|
|
|||
|
|
@ -227,6 +227,7 @@ void BroDoc::WriteDocFile() const
|
|||
WriteToDoc("%s\n", packet_filter.c_str());
|
||||
}
|
||||
|
||||
#if 0 // Disabled for now.
|
||||
BroDocObjList::const_iterator it;
|
||||
bool hasPrivateIdentifiers = false;
|
||||
|
||||
|
|
@ -241,6 +242,7 @@ void BroDoc::WriteDocFile() const
|
|||
|
||||
if ( hasPrivateIdentifiers )
|
||||
WriteInterface("Private Interface", '-', '~', false, false);
|
||||
#endif
|
||||
}
|
||||
|
||||
void BroDoc::WriteInterface(const char* heading, char underline,
|
||||
|
|
|
|||
13
src/BroDoc.h
13
src/BroDoc.h
|
|
@ -167,6 +167,18 @@ public:
|
|||
all.push_back(o);
|
||||
}
|
||||
|
||||
/**
|
||||
* Schedules documentation of an event handler declared by the script.
|
||||
* @param o A pointer to a BroDocObj which contains the internal
|
||||
* Bro language representation of the script event handler and
|
||||
* also any associated comments about it.
|
||||
*/
|
||||
void AddEventHandler(const BroDocObj* o)
|
||||
{
|
||||
event_handlers.push_back(o);
|
||||
all.push_back(o);
|
||||
}
|
||||
|
||||
/**
|
||||
* Schedules documentation of a function declared by the script.
|
||||
* @param o A pointer to a BroDocObj which contains the internal
|
||||
|
|
@ -228,6 +240,7 @@ protected:
|
|||
BroDocObjList types;
|
||||
BroDocObjList notices;
|
||||
BroDocObjList events;
|
||||
BroDocObjList event_handlers;
|
||||
BroDocObjMap functions;
|
||||
BroDocObjList redefs;
|
||||
|
||||
|
|
|
|||
|
|
@ -418,6 +418,7 @@ collect_headers(bro_HEADERS ${bro_SRCS})
|
|||
|
||||
add_definitions(-DBRO_SCRIPT_INSTALL_PATH="${BRO_SCRIPT_INSTALL_PATH}")
|
||||
add_definitions(-DBRO_SCRIPT_SOURCE_PATH="${BRO_SCRIPT_SOURCE_PATH}")
|
||||
add_definitions(-DBRO_BUILD_PATH="${CMAKE_CURRENT_BINARY_DIR}")
|
||||
|
||||
add_executable(bro ${bro_SRCS} ${bro_HEADERS})
|
||||
|
||||
|
|
|
|||
|
|
@ -455,7 +455,7 @@ LogMgr::WriterInfo* LogMgr::FindWriter(LogWriter* writer)
|
|||
{
|
||||
WriterInfo* winfo = i->second;
|
||||
|
||||
if ( winfo->writer == writer )
|
||||
if ( winfo && winfo->writer == writer )
|
||||
return winfo;
|
||||
}
|
||||
}
|
||||
|
|
@ -1532,7 +1532,8 @@ bool LogMgr::FinishedRotation(LogWriter* writer, string new_name, string old_nam
|
|||
writer->Path().c_str(), network_time, new_name.c_str());
|
||||
|
||||
WriterInfo* winfo = FindWriter(writer);
|
||||
assert(winfo);
|
||||
if ( ! winfo )
|
||||
return true;
|
||||
|
||||
RecordVal* rc =
|
||||
LookupRotationControl(winfo->type, winfo->writer->Path());
|
||||
|
|
|
|||
10
src/bro.bif
10
src/bro.bif
|
|
@ -3405,10 +3405,18 @@ function bro_has_ipv6%(%) : bool
|
|||
function unique_id%(prefix: string%) : string
|
||||
%{
|
||||
char tmp[20];
|
||||
uint64 uid = calculate_unique_id();
|
||||
uint64 uid = calculate_unique_id(UID_POOL_DEFAULT_SCRIPT);
|
||||
return new StringVal(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
|
||||
%}
|
||||
|
||||
function unique_id_from%(pool: int, prefix: string%) : string
|
||||
%{
|
||||
pool += UID_POOL_CUSTOM_SCRIPT; // Make sure we don't conflict with internal pool.
|
||||
|
||||
char tmp[20];
|
||||
uint64 uid = calculate_unique_id(pool);
|
||||
return new StringVal(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
|
||||
%}
|
||||
%%{
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/asn1.h>
|
||||
|
|
|
|||
|
|
@ -1179,7 +1179,7 @@ func_hdr:
|
|||
FUNC_FLAVOR_EVENT, 0, $3);
|
||||
$$ = $3;
|
||||
if ( generate_documentation )
|
||||
current_reST_doc->AddEvent(
|
||||
current_reST_doc->AddEventHandler(
|
||||
new BroDocObj($2, reST_doc_comments));
|
||||
}
|
||||
| TOK_REDEF TOK_EVENT event_id func_params
|
||||
|
|
|
|||
38
src/scan.l
38
src/scan.l
|
|
@ -80,6 +80,19 @@ static const char* canon_doc_comment(const char* comment)
|
|||
return ( comment[0] == ' ' ) ? comment + 1 : comment;
|
||||
}
|
||||
|
||||
static std::string canon_doc_func_param(const char* id_start)
|
||||
{
|
||||
std::string id_name(id_start, strcspn(id_start, ":"));
|
||||
const char* comment = id_start + id_name.size() + 1;
|
||||
std::string doc;
|
||||
|
||||
if ( id_name == "Returns" )
|
||||
doc.append(":returns:").append(comment);
|
||||
else
|
||||
doc.append(":param ").append(id_name).append(":").append(comment);
|
||||
return doc;
|
||||
}
|
||||
|
||||
static ino_t get_inode_num(FILE* f, const char* filename)
|
||||
{
|
||||
struct stat b;
|
||||
|
|
@ -155,6 +168,12 @@ ESCSEQ (\\([^\n]|[0-7]+|x[[:xdigit:]]+))
|
|||
return TOK_POST_DOC;
|
||||
}
|
||||
|
||||
<DOC>##{OWS}{ID}:.* {
|
||||
const char* id_start = skip_whitespace(yytext + 2);
|
||||
yylval.str = copy_string(canon_doc_func_param(id_start).c_str());
|
||||
return TOK_DOC;
|
||||
}
|
||||
|
||||
<DOC>##.* {
|
||||
if ( yytext[2] != '#' )
|
||||
{
|
||||
|
|
@ -169,20 +188,6 @@ ESCSEQ (\\([^\n]|[0-7]+|x[[:xdigit:]]+))
|
|||
// Comment is documenting either a function parameter or return type,
|
||||
// so appropriate reST markup substitutions are automatically made
|
||||
// in order to distinguish them from other comments.
|
||||
const char* id_start = skip_whitespace(yytext + 2);
|
||||
size_t id_len = strcspn(id_start, ":");
|
||||
char* id_name = new char[id_len + 1];
|
||||
strncpy(id_name, id_start, id_len);
|
||||
id_name[id_len] = '\0';
|
||||
const char* comment = id_start + id_len + 1;
|
||||
|
||||
std::string doc;
|
||||
|
||||
if ( streq(id_name, "Returns") )
|
||||
doc.append(":returns:").append(comment);
|
||||
else
|
||||
doc.append(":param ").append(id_name).append(":").append(comment);
|
||||
|
||||
if ( ! reST_doc_comments )
|
||||
reST_doc_comments = new std::list<std::string>();
|
||||
|
||||
|
|
@ -192,9 +197,8 @@ ESCSEQ (\\([^\n]|[0-7]+|x[[:xdigit:]]+))
|
|||
// 2) has a blank line between it and non-field-list reST markup,
|
||||
// which is required for correct HTML rendering by Sphinx
|
||||
reST_doc_comments->push_back("");
|
||||
reST_doc_comments->push_back(doc);
|
||||
|
||||
delete [] id_name;
|
||||
const char* id_start = skip_whitespace(yytext + 2);
|
||||
reST_doc_comments->push_back(canon_doc_func_param(id_start));
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
79
src/util.cc
79
src/util.cc
|
|
@ -891,7 +891,7 @@ const char* normalize_path(const char* path)
|
|||
return copy_string(new_path.c_str());
|
||||
}
|
||||
|
||||
// Returns the subpath of the root Bro script install/source directory in
|
||||
// Returns the subpath of the root Bro script install/source/build directory in
|
||||
// which the loaded file is located. If it's not under a subpath of that
|
||||
// directory (e.g. cwd or custom path) then the full path is returned.
|
||||
void get_script_subpath(const std::string& full_filename, const char** subpath)
|
||||
|
|
@ -909,11 +909,15 @@ void get_script_subpath(const std::string& full_filename, const char** subpath)
|
|||
|
||||
// first check if this is some subpath of the installed scripts root path,
|
||||
// if not check if it's a subpath of the script source root path,
|
||||
// if neither, will just use the given directory
|
||||
if ( (p=my_subpath.find(BRO_SCRIPT_INSTALL_PATH)) != std::string::npos )
|
||||
// then check if it's a subpath of the build directory (where BIF scripts
|
||||
// will get generated).
|
||||
// If none of those, will just use the given directory.
|
||||
if ( (p = my_subpath.find(BRO_SCRIPT_INSTALL_PATH)) != std::string::npos )
|
||||
my_subpath.erase(0, strlen(BRO_SCRIPT_INSTALL_PATH));
|
||||
else if ( (p=my_subpath.find(BRO_SCRIPT_SOURCE_PATH)) != std::string::npos )
|
||||
else if ( (p = my_subpath.find(BRO_SCRIPT_SOURCE_PATH)) != std::string::npos )
|
||||
my_subpath.erase(0, strlen(BRO_SCRIPT_SOURCE_PATH));
|
||||
else if ( (p = my_subpath.find(BRO_BUILD_PATH)) != std::string::npos )
|
||||
my_subpath.erase(0, strlen(BRO_BUILD_PATH));
|
||||
|
||||
// if root path found, remove path separators until next path component
|
||||
if ( p != std::string::npos )
|
||||
|
|
@ -1182,15 +1186,44 @@ int time_compare(struct timeval* tv_a, struct timeval* tv_b)
|
|||
return tv_a->tv_sec - tv_b->tv_sec;
|
||||
}
|
||||
|
||||
static uint64 uid_counter; // Counter for unique IDs.
|
||||
static uint64 uid_instance; // Instance ID, computed once.
|
||||
struct UIDEntry {
|
||||
UIDEntry() : key(0, 0), needs_init(true) { }
|
||||
UIDEntry(const uint64 i) : key(i, 0), needs_init(false) { }
|
||||
|
||||
struct UIDKey {
|
||||
UIDKey(uint64 i, uint64 c) : instance(i), counter(c) { }
|
||||
uint64 instance;
|
||||
uint64 counter;
|
||||
} key;
|
||||
|
||||
bool needs_init;
|
||||
};
|
||||
|
||||
static std::vector<UIDEntry> uid_pool;
|
||||
|
||||
uint64 calculate_unique_id()
|
||||
{
|
||||
if ( uid_instance == 0 )
|
||||
{
|
||||
// This is the first time we need a UID.
|
||||
return calculate_unique_id(UID_POOL_DEFAULT_INTERNAL);
|
||||
}
|
||||
|
||||
uint64 calculate_unique_id(size_t pool)
|
||||
{
|
||||
uint64 uid_instance = 0;
|
||||
|
||||
if( pool >= uid_pool.size() )
|
||||
{
|
||||
if ( pool < 10000 )
|
||||
uid_pool.resize(pool + 1);
|
||||
else
|
||||
{
|
||||
reporter->Warning("pool passed to calculate_unique_id() too large, using default");
|
||||
pool = UID_POOL_DEFAULT_INTERNAL;
|
||||
}
|
||||
}
|
||||
|
||||
if ( uid_pool[pool].needs_init )
|
||||
{
|
||||
// This is the first time we need a UID for this pool.
|
||||
if ( ! have_random_seed() )
|
||||
{
|
||||
// If we don't need deterministic output (as
|
||||
|
|
@ -1198,39 +1231,37 @@ uint64 calculate_unique_id()
|
|||
// instance ID by hashing something likely to be
|
||||
// globally unique.
|
||||
struct {
|
||||
char hostname[128];
|
||||
char hostname[120];
|
||||
uint64 pool;
|
||||
struct timeval time;
|
||||
pid_t pid;
|
||||
int rnd;
|
||||
} unique;
|
||||
|
||||
memset(&unique, 0, sizeof(unique)); // Make valgrind happy.
|
||||
gethostname(unique.hostname, 128);
|
||||
gethostname(unique.hostname, 120);
|
||||
unique.hostname[sizeof(unique.hostname)-1] = '\0';
|
||||
gettimeofday(&unique.time, 0);
|
||||
unique.pool = (uint64) pool;
|
||||
unique.pid = getpid();
|
||||
unique.rnd = bro_random();
|
||||
|
||||
uid_instance = HashKey::HashBytes(&unique, sizeof(unique));
|
||||
++uid_instance; // Now it's larger than zero.
|
||||
}
|
||||
|
||||
else
|
||||
// Generate determistic UIDs.
|
||||
uid_instance = 1;
|
||||
// Generate determistic UIDs for each individual pool.
|
||||
uid_instance = pool;
|
||||
|
||||
// Our instance is unique. Huzzah.
|
||||
uid_pool[pool] = UIDEntry(uid_instance);
|
||||
}
|
||||
|
||||
// Now calculate the unique ID.
|
||||
struct {
|
||||
uint64 counter;
|
||||
hash_t instance;
|
||||
} key;
|
||||
assert(!uid_pool[pool].needs_init);
|
||||
assert(uid_pool[pool].key.instance != 0);
|
||||
|
||||
key.counter = ++uid_counter;
|
||||
key.instance = uid_instance;
|
||||
|
||||
uint64_t h = HashKey::HashBytes(&key, sizeof(key));
|
||||
return h;
|
||||
++uid_pool[pool].key.counter;
|
||||
return HashKey::HashBytes(&(uid_pool[pool].key), sizeof(uid_pool[pool].key));
|
||||
}
|
||||
|
||||
void out_of_memory(const char* where)
|
||||
|
|
|
|||
|
|
@ -225,8 +225,14 @@ extern struct timeval double_to_timeval(double t);
|
|||
extern int time_compare(struct timeval* tv_a, struct timeval* tv_b);
|
||||
|
||||
// Returns an integer that's very likely to be unique, even across Bro
|
||||
// instances.
|
||||
// instances. The integer can be drawn from different pools, which is helpful
|
||||
// when the randon number generator is seeded to be deterministic. In that
|
||||
// case, the same sequence of integers is generated per pool.
|
||||
#define UID_POOL_DEFAULT_INTERNAL 1
|
||||
#define UID_POOL_DEFAULT_SCRIPT 2
|
||||
#define UID_POOL_CUSTOM_SCRIPT 10 // First available custom script level pool.
|
||||
extern uint64 calculate_unique_id();
|
||||
extern uint64 calculate_unique_id(const size_t pool);
|
||||
|
||||
// For now, don't use hash_maps - they're not fully portable.
|
||||
#if 0
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
6
|
||||
12
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
A-UWkUyAuUGXf
|
||||
B-56gKBmhBBB6
|
||||
C-50da4BEzauh
|
||||
A-56gKBmhBBB6
|
||||
B-PjbroujOxH4
|
||||
C-N4zgPFAv3J
|
||||
D-R8BqVlcp23e
|
||||
E-duYdXg7bTa3
|
||||
F-FSX5JvMaA88
|
||||
|
|
|
|||
|
|
@ -1,39 +1,39 @@
|
|||
[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
|
||||
[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
|
||||
[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
|
||||
[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
|
||||
[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
|
||||
[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
|
||||
[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
|
||||
[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
|
||||
[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
|
||||
[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
|
||||
[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
|
||||
[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
|
||||
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
|
||||
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
|
||||
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
|
||||
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
|
||||
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
|
||||
[orig_h=173.192.163.128, orig_p=80/tcp, resp_h=141.142.220.235, resp_p=6705/tcp], tpUWfNdSLE
|
||||
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
|
||||
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
|
||||
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
|
||||
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
|
||||
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
|
||||
[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], arKYeMETxOg
|
||||
[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], k6kgXLOoSKl
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], nQcgTWjvg4c
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], nQcgTWjvg4c
|
||||
[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], j4u32Pc5bif
|
||||
[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], TEfuqmmG4bh
|
||||
[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], FrJExwHcSal
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 5OKnoww6xl4
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 3PKsZ2Uye21
|
||||
[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], VW0XPVINV8a
|
||||
[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], fRFu0wcOle6
|
||||
[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], qSsw6ESzHV4
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], iE6yhOq3SF
|
||||
[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], GSxOnSLghOa
|
||||
[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], qCaWGmzFtM5
|
||||
[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], 70MGiRM1Qf4
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], h5DsfNtYzi1
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], P654jzLoe3a
|
||||
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], Tw8jXtpTGu6
|
||||
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], c4Zw9TmAE05
|
||||
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], EAr0uf4mhq
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], GvmoxJFXdTa
|
||||
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], 0Q4FH8sESw5
|
||||
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], slFea8xwSmb
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], UfGkYA2HI2g
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 3PKsZ2Uye21
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 5OKnoww6xl4
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], iE6yhOq3SF
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], P654jzLoe3a
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], h5DsfNtYzi1
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], GvmoxJFXdTa
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], UfGkYA2HI2g
|
||||
[orig_h=173.192.163.128, orig_p=80/tcp, resp_h=141.142.220.235, resp_p=6705/tcp], i2rO3KD1Syg
|
||||
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 2cx26uAvUPl
|
||||
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], BWaU4aSuwkc
|
||||
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], 10XodEwRycf
|
||||
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], zno26fFZkrh
|
||||
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], v5rgkJBig5l
|
||||
|
|
|
|||
|
|
@ -1,39 +1,39 @@
|
|||
[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
|
||||
[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
|
||||
[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
|
||||
[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
|
||||
[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
|
||||
[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
|
||||
[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
|
||||
[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
|
||||
[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
|
||||
[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
|
||||
[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
|
||||
[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
|
||||
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
|
||||
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
|
||||
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
|
||||
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
|
||||
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
|
||||
[orig_h=173.192.163.128, orig_p=80/tcp, resp_h=141.142.220.235, resp_p=6705/tcp], tpUWfNdSLE
|
||||
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
|
||||
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
|
||||
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
|
||||
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
|
||||
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
|
||||
[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], arKYeMETxOg
|
||||
[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], k6kgXLOoSKl
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], nQcgTWjvg4c
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], nQcgTWjvg4c
|
||||
[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], j4u32Pc5bif
|
||||
[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], TEfuqmmG4bh
|
||||
[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], FrJExwHcSal
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 5OKnoww6xl4
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 3PKsZ2Uye21
|
||||
[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], VW0XPVINV8a
|
||||
[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], fRFu0wcOle6
|
||||
[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], qSsw6ESzHV4
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], iE6yhOq3SF
|
||||
[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], GSxOnSLghOa
|
||||
[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], qCaWGmzFtM5
|
||||
[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], 70MGiRM1Qf4
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], h5DsfNtYzi1
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], P654jzLoe3a
|
||||
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], Tw8jXtpTGu6
|
||||
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], c4Zw9TmAE05
|
||||
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], EAr0uf4mhq
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], GvmoxJFXdTa
|
||||
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], 0Q4FH8sESw5
|
||||
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], slFea8xwSmb
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], UfGkYA2HI2g
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 3PKsZ2Uye21
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 5OKnoww6xl4
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], iE6yhOq3SF
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], P654jzLoe3a
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], h5DsfNtYzi1
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], GvmoxJFXdTa
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], UfGkYA2HI2g
|
||||
[orig_h=173.192.163.128, orig_p=80/tcp, resp_h=141.142.220.235, resp_p=6705/tcp], i2rO3KD1Syg
|
||||
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 2cx26uAvUPl
|
||||
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], BWaU4aSuwkc
|
||||
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], 10XodEwRycf
|
||||
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], zno26fFZkrh
|
||||
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], v5rgkJBig5l
|
||||
|
|
|
|||
|
|
@ -1,39 +1,39 @@
|
|||
[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
|
||||
[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
|
||||
[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
|
||||
[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
|
||||
[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
|
||||
[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
|
||||
[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
|
||||
[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
|
||||
[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
|
||||
[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
|
||||
[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
|
||||
[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
|
||||
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
|
||||
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
|
||||
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
|
||||
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
|
||||
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
|
||||
[orig_h=173.192.163.128, orig_p=80/tcp, resp_h=141.142.220.235, resp_p=6705/tcp], tpUWfNdSLE
|
||||
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
|
||||
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
|
||||
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
|
||||
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
|
||||
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
|
||||
[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], arKYeMETxOg
|
||||
[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], k6kgXLOoSKl
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], nQcgTWjvg4c
|
||||
[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], nQcgTWjvg4c
|
||||
[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], j4u32Pc5bif
|
||||
[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], TEfuqmmG4bh
|
||||
[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], FrJExwHcSal
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 5OKnoww6xl4
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 3PKsZ2Uye21
|
||||
[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], VW0XPVINV8a
|
||||
[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], fRFu0wcOle6
|
||||
[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], qSsw6ESzHV4
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], iE6yhOq3SF
|
||||
[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], GSxOnSLghOa
|
||||
[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], qCaWGmzFtM5
|
||||
[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], 70MGiRM1Qf4
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], h5DsfNtYzi1
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], P654jzLoe3a
|
||||
[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], Tw8jXtpTGu6
|
||||
[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], c4Zw9TmAE05
|
||||
[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], EAr0uf4mhq
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], GvmoxJFXdTa
|
||||
[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], 0Q4FH8sESw5
|
||||
[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], slFea8xwSmb
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], UfGkYA2HI2g
|
||||
[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 3PKsZ2Uye21
|
||||
[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], 5OKnoww6xl4
|
||||
[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], iE6yhOq3SF
|
||||
[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], P654jzLoe3a
|
||||
[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], h5DsfNtYzi1
|
||||
[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], GvmoxJFXdTa
|
||||
[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], UfGkYA2HI2g
|
||||
[orig_h=173.192.163.128, orig_p=80/tcp, resp_h=141.142.220.235, resp_p=6705/tcp], i2rO3KD1Syg
|
||||
[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 2cx26uAvUPl
|
||||
[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], BWaU4aSuwkc
|
||||
[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], 10XodEwRycf
|
||||
[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], zno26fFZkrh
|
||||
[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], v5rgkJBig5l
|
||||
|
|
|
|||
|
|
@ -3,5 +3,5 @@
|
|||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes
|
||||
#types time string addr port addr port enum string interval count count string bool count string count count count count
|
||||
952109346.874907 UWkUyAuUGXf 10.1.2.1 11001 10.34.0.1 23 tcp - 2.102560 25 0 SH - 0 - 11 280 0 0
|
||||
1128727435.450898 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 710 10 9945
|
||||
1278600802.069419 50da4BEzauh 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - 0 ShADadfF 7 361 7 3801
|
||||
1128727435.450898 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - 0 ShADdFaf 12 710 10 9945
|
||||
1278600802.069419 k6kgXLOoSKl 10.20.80.1 50343 10.0.0.15 80 tcp - 0.004152 9 3429 SF - 0 ShADadfF 7 361 7 3801
|
||||
|
|
|
|||
|
|
@ -15,20 +15,6 @@ these comments are transferred directly into the auto-generated
|
|||
|
||||
.. tip:: You can embed directives and roles within ``##``-stylized comments.
|
||||
|
||||
A script's logging information has to be documented manually as minimally
|
||||
shown below. Note that references may not always be possible (e.g.
|
||||
anonymous filter functions) and a script may not need to document
|
||||
each of "columns", "event", "filter" depending on exactly what it's doing.
|
||||
|
||||
**Logging Stream ID:** :bro:enum:`Example::EXAMPLE`
|
||||
:Columns: :bro:type:`Example::Info`
|
||||
:Event: :bro:id:`Example::log_example`
|
||||
:Filter: ``example-filter``
|
||||
uses :bro:id:`Example::filter_func` to determine whether to
|
||||
exclude the ``ts`` field
|
||||
|
||||
:Author: Jon Siwek <jsiwek@ncsa.illinois.edu>
|
||||
|
||||
:Imports: :doc:`policy/frameworks/software/vulnerable </scripts/policy/frameworks/software/vulnerable>`
|
||||
|
||||
Summary
|
||||
|
|
@ -72,8 +58,6 @@ Events
|
|||
|
||||
:bro:id:`Example::log_example`: :bro:type:`event` This is a declaration of an example event that can be used in
|
||||
logging streams and is raised once for each log entry.
|
||||
|
||||
:bro:id:`bro_init`: :bro:type:`event`
|
||||
================================================= =============================================================
|
||||
|
||||
Functions
|
||||
|
|
@ -233,10 +217,6 @@ Events
|
|||
This is a declaration of an example event that can be used in
|
||||
logging streams and is raised once for each log entry.
|
||||
|
||||
.. bro:id:: bro_init
|
||||
|
||||
:Type: :bro:type:`event` ()
|
||||
|
||||
Functions
|
||||
~~~~~~~~~
|
||||
.. bro:id:: Example::a_function
|
||||
|
|
@ -309,40 +289,3 @@ Filters added::
|
|||
[ssl] = tcp port 443,
|
||||
[nntps] = tcp port 562
|
||||
|
||||
Private Interface
|
||||
-----------------
|
||||
State Variables
|
||||
~~~~~~~~~~~~~~~
|
||||
.. bro:id:: Example::example_ports
|
||||
|
||||
:Type: :bro:type:`set` [:bro:type:`port`]
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default:
|
||||
|
||||
::
|
||||
|
||||
{
|
||||
443/tcp,
|
||||
562/tcp
|
||||
}
|
||||
|
||||
Types
|
||||
~~~~~
|
||||
.. bro:type:: Example::PrivateRecord
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
field1: :bro:type:`bool`
|
||||
|
||||
field2: :bro:type:`count`
|
||||
|
||||
Functions
|
||||
~~~~~~~~~
|
||||
.. bro:id:: Example::filter_func
|
||||
|
||||
:Type: :bro:type:`function` (rec: :bro:type:`Example::Info`) : :bro:type:`bool`
|
||||
|
||||
.. bro:id:: Example::function_without_proto
|
||||
|
||||
:Type: :bro:type:`function` (tag: :bro:type:`string`) : :bro:type:`string`
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,57 @@
|
|||
.. Automatically generated. Do not edit.
|
||||
|
||||
autogen-reST-func-params.bro
|
||||
============================
|
||||
|
||||
:download:`Original Source File <autogen-reST-func-params.bro>`
|
||||
|
||||
Overview
|
||||
--------
|
||||
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Types
|
||||
#####
|
||||
======================================== =
|
||||
:bro:type:`test_rec`: :bro:type:`record`
|
||||
======================================== =
|
||||
|
||||
Functions
|
||||
#########
|
||||
===================================== ======================================
|
||||
:bro:id:`test_func`: :bro:type:`func` This is a global function declaration.
|
||||
===================================== ======================================
|
||||
|
||||
Public Interface
|
||||
----------------
|
||||
Types
|
||||
~~~~~
|
||||
.. bro:type:: test_rec
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
field_func: :bro:type:`function` (i: :bro:type:`int`, j: :bro:type:`int`) : :bro:type:`string`
|
||||
This is a record field function.
|
||||
|
||||
:param i: First param.
|
||||
:param j: Second param.
|
||||
|
||||
:returns: A string.
|
||||
|
||||
Functions
|
||||
~~~~~~~~~
|
||||
.. bro:id:: test_func
|
||||
|
||||
:Type: :bro:type:`function` (i: :bro:type:`int`, j: :bro:type:`int`) : :bro:type:`string`
|
||||
|
||||
This is a global function declaration.
|
||||
|
||||
|
||||
:param i: First param.
|
||||
|
||||
:param j: Second param.
|
||||
|
||||
|
||||
:returns: A string.
|
||||
|
||||
|
|
@ -2,4 +2,4 @@
|
|||
#path http
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file
|
||||
#types time string addr port addr port string string string string string count count count string string table string string table string string file
|
||||
1315167107.671488 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
1315248437.500464 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@
|
|||
#path http
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file
|
||||
#types time string addr port addr port string string string string string count count count string string table string string table string string file
|
||||
1315167107.671488 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
1315248437.500464 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@
|
|||
#path http
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file
|
||||
#types time string addr port addr port string string string string string count count count string string table string string table string string file
|
||||
1315167116.842377 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
1315248460.480614 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@
|
|||
#path http
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file
|
||||
#types time string addr port addr port string string string string string count count count string string table string string table string string file
|
||||
1315167116.842377 56gKBmhBBB6 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
1315248460.480614 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 - 9130 200 OK - - - - - text/html - -
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
# ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file
|
||||
#separator \x09
|
||||
#path http
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_content_length response_content_length status_code status_msg filename tags username password proxied mime_type md5 extraction_file
|
||||
#types time string addr port addr port string string string string string count count count string string table string string table string string file
|
||||
1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 946 200 OK - - - - - FAKE_MIME - -
|
||||
1258577884.960135 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /script/urchin.js http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 6716 200 OK - - - - - FAKE_MIME - -
|
||||
1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 - 94 200 OK - - - - - FAKE_MIME - -
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
# ts uid id.orig_h id.orig_p id.resp_h id.resp_p nick user channels command value addl tags dcc_file_name dcc_file_size dcc_mime_type extraction_file
|
||||
#separator \x09
|
||||
#path irc
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p nick user channels command value addl tags dcc_file_name dcc_file_size dcc_mime_type extraction_file
|
||||
#types time string addr port addr port string string table string string string table string count string file
|
||||
1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 - - - NICK bloed - - - - - -
|
||||
1311189164.119437 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed - - USER sdkfje sdkfje Montreal.QC.CA.Undernet.org dkdkrwq - - - - -
|
||||
1311189174.474127 UWkUyAuUGXf 192.168.1.77 57640 66.198.80.67 6667 bloed sdkfje - JOIN #easymovies - - - - - -
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@
|
|||
#path smtp
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid helo mailfrom rcptto date from to reply_to msg_id in_reply_to subject x_originating_ip first_received second_received last_reply path user_agent
|
||||
#types time string addr port addr port string string string table string string table string string string string addr string string string vector string
|
||||
1254722768.219663 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh GP <gurpartap@patriots.in> <raj_deol2002in@yahoo.co.in> Mon, 5 Oct 2009 11:36:07 +0530 "Gurpartap Singh" <gurpartap@patriots.in> <raj_deol2002in@yahoo.co.in> - <000301ca4581$ef9e57f0$cedb07d0$@in> - SMTP - - - 250 OK id=1Mugho-0003Dg-Un 74.53.140.153,10.10.1.4 Microsoft Office Outlook 12.0
|
||||
1254722768.219663 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 @56gKBmhBBB6 GP <gurpartap@patriots.in> <raj_deol2002in@yahoo.co.in> Mon, 5 Oct 2009 11:36:07 +0530 "Gurpartap Singh" <gurpartap@patriots.in> <raj_deol2002in@yahoo.co.in> - <000301ca4581$ef9e57f0$cedb07d0$@in> - SMTP - - - 250 OK id=1Mugho-0003Dg-Un 74.53.140.153,10.10.1.4 Microsoft Office Outlook 12.0
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
# ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid filename content_len mime_type md5 extraction_file excerpt
|
||||
1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 79 FAKE_MIME - smtp-entity_10.10.1.4:1470-74.53.140.153:25_1.dat -
|
||||
1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 1918 FAKE_MIME - - -
|
||||
1254722770.692804 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh NEWS.txt 10823 FAKE_MIME - smtp-entity_10.10.1.4:1470-74.53.140.153:25_2.dat -
|
||||
#separator \x09
|
||||
#path smtp_entities
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid filename content_len mime_type md5 extraction_file excerpt
|
||||
#types time string addr port addr port string string count string string file string
|
||||
1254722770.692743 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 @56gKBmhBBB6 - 79 FAKE_MIME - smtp-entity_10.10.1.4:1470-74.53.140.153:25_1.dat -
|
||||
1254722770.692743 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 @56gKBmhBBB6 - 1918 FAKE_MIME - - -
|
||||
1254722770.692804 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 @56gKBmhBBB6 NEWS.txt 10823 FAKE_MIME - smtp-entity_10.10.1.4:1470-74.53.140.153:25_2.dat -
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
# ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid filename content_len mime_type md5 extraction_file excerpt
|
||||
1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 79 FAKE_MIME 92bca2e6cdcde73647125da7dccbdd07 - -
|
||||
1254722770.692743 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh - 1918 FAKE_MIME - - -
|
||||
1254722770.692804 56gKBmhBBB6 10.10.1.4 1470 74.53.140.153 25 @50da4BEzauh NEWS.txt 10823 FAKE_MIME a968bb0f9f9d95835b2e74c845877e87 - -
|
||||
#separator \x09
|
||||
#path smtp_entities
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p mid filename content_len mime_type md5 extraction_file excerpt
|
||||
#types time string addr port addr port string string count string string file string
|
||||
1254722770.692743 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 @56gKBmhBBB6 - 79 FAKE_MIME 92bca2e6cdcde73647125da7dccbdd07 - -
|
||||
1254722770.692743 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 @56gKBmhBBB6 - 1918 FAKE_MIME - - -
|
||||
1254722770.692804 arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 @56gKBmhBBB6 NEWS.txt 10823 FAKE_MIME a968bb0f9f9d95835b2e74c845877e87 - -
|
||||
|
|
|
|||
27
testing/btest/bifs/unique_id-pools.bro
Normal file
27
testing/btest/bifs/unique_id-pools.bro
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
#
|
||||
# @TEST-EXEC: bro order_rand | sort >out.1
|
||||
# @TEST-EXEC: bro order_base | sort >out.2
|
||||
# @TEST-EXEC: cmp out.1 out.2
|
||||
|
||||
@TEST-START-FILE order_rand.bro
|
||||
|
||||
print unique_id("A-");
|
||||
print unique_id_from(5, "E-");
|
||||
print unique_id("B-");
|
||||
print unique_id_from(4, "D-");
|
||||
print unique_id("C-");
|
||||
print unique_id_from(5, "F-");
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
@TEST-START-FILE order_base.bro
|
||||
|
||||
print unique_id("A-");
|
||||
print unique_id("B-");
|
||||
print unique_id("C-");
|
||||
print unique_id_from(4, "D-");
|
||||
print unique_id_from(5, "E-");
|
||||
print unique_id_from(5, "F-");
|
||||
|
||||
@TEST-END-FILE
|
||||
|
||||
|
|
@ -7,3 +7,6 @@
|
|||
print unique_id("A-");
|
||||
print unique_id("B-");
|
||||
print unique_id("C-");
|
||||
print unique_id_from(4, "D-");
|
||||
print unique_id_from(5, "E-");
|
||||
print unique_id_from(5, "F-");
|
||||
|
|
|
|||
|
|
@ -5,3 +5,6 @@
|
|||
print unique_id("A-");
|
||||
print unique_id("B-");
|
||||
print unique_id("C-");
|
||||
print unique_id_from(4, "D-");
|
||||
print unique_id_from(5, "E-");
|
||||
print unique_id_from(5, "F-");
|
||||
|
|
|
|||
20
testing/btest/doc/autogen-reST-func-params.bro
Normal file
20
testing/btest/doc/autogen-reST-func-params.bro
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
# @TEST-EXEC: bro --doc-scripts %INPUT
|
||||
# @TEST-EXEC: btest-diff autogen-reST-func-params.rst
|
||||
|
||||
## This is a global function declaration.
|
||||
##
|
||||
## i: First param.
|
||||
## j: Second param.
|
||||
##
|
||||
## Returns: A string.
|
||||
global test_func: function(i: int, j: int): string;
|
||||
|
||||
type test_rec: record {
|
||||
## This is a record field function.
|
||||
##
|
||||
## i: First param.
|
||||
## j: Second param.
|
||||
##
|
||||
## Returns: A string.
|
||||
field_func: function(i: int, j: int): string;
|
||||
};
|
||||
Loading…
Add table
Add a link
Reference in a new issue