Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/fastpath'

Browse source 
* origin/fastpath:
  Documentation fixes.
  Replace ip6_hdr_chain with ip6_ext_hdr in comments
  Correct various errors in the BIF documentation
This commit is contained in:
Robin Sommer 2012-05-24 16:46:06 -07:00
commit d92da36b9b
7 changed files with 161 additions and 154 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.0-377 | 2012-05-24 16:46:06 -0700
* Documentation fixes. (Jon Siwek and Daniel Thayer)
2.0-372 | 2012-05-17 13:59:45 -0700 2.0-372 | 2012-05-17 13:59:45 -0700
* Fix compile errors. (Jon Siwek) * Fix compile errors. (Jon Siwek)

2
VERSION
View file

@ -1 +1 @@
2.0-372 2.0-377

38
scripts/base/init-bare.bro
View file

@ -219,7 +219,7 @@ type connection: record {
service: set[string]; service: set[string];
addl: string; ##< Deprecated. addl: string; ##< Deprecated.
hot: count; ##< Deprecated. hot: count; ##< Deprecated.
history: string; ##< State history of TCP connections. See *history* in :bro:see:`Conn::Info`. history: string; ##< State history of connections. See *history* in :bro:see:`Conn::Info`.
## A globally unique connection identifier. For each connection, Bro creates an ID ## A globally unique connection identifier. For each connection, Bro creates an ID
## that is very likely unique across independent Bro runs. These IDs can thus be ## that is very likely unique across independent Bro runs. These IDs can thus be
## used to tag and locate information associated with that connection. ## used to tag and locate information associated with that connection.
@ -967,7 +967,7 @@ const IPPROTO_MOBILITY = 135; ##< IPv6 mobility header.
## Values extracted from an IPv6 extension header's (e.g. hop-by-hop or ## Values extracted from an IPv6 extension header's (e.g. hop-by-hop or
## destination option headers) option field. ## destination option headers) option field.
## ##
## .. bro:see:: ip6_hdr ip6_hdr_chain ip6_hopopts ip6_dstopts ## .. bro:see:: ip6_hdr ip6_ext_hdr ip6_hopopts ip6_dstopts
type ip6_option: record { type ip6_option: record {
otype: count; ##< Option type. otype: count; ##< Option type.
len: count; ##< Option data length. len: count; ##< Option data length.
@ -976,7 +976,7 @@ type ip6_option: record {
## Values extracted from an IPv6 Hop-by-Hop options extension header. ## Values extracted from an IPv6 Hop-by-Hop options extension header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ip6_option ## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr ip6_option
type ip6_hopopts: record { type ip6_hopopts: record {
## Protocol number of the next header (RFC 1700 et seq., IANA assigned ## Protocol number of the next header (RFC 1700 et seq., IANA assigned
## number), e.g. :bro:id:`IPPROTO_ICMP`. ## number), e.g. :bro:id:`IPPROTO_ICMP`.
@ -989,7 +989,7 @@ type ip6_hopopts: record {
## Values extracted from an IPv6 Destination options extension header. ## Values extracted from an IPv6 Destination options extension header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ip6_option ## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr ip6_option
type ip6_dstopts: record { type ip6_dstopts: record {
## Protocol number of the next header (RFC 1700 et seq., IANA assigned ## Protocol number of the next header (RFC 1700 et seq., IANA assigned
## number), e.g. :bro:id:`IPPROTO_ICMP`. ## number), e.g. :bro:id:`IPPROTO_ICMP`.
@ -1002,7 +1002,7 @@ type ip6_dstopts: record {
## Values extracted from an IPv6 Routing extension header. ## Values extracted from an IPv6 Routing extension header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
type ip6_routing: record { type ip6_routing: record {
## Protocol number of the next header (RFC 1700 et seq., IANA assigned ## Protocol number of the next header (RFC 1700 et seq., IANA assigned
## number), e.g. :bro:id:`IPPROTO_ICMP`. ## number), e.g. :bro:id:`IPPROTO_ICMP`.
@ -1019,7 +1019,7 @@ type ip6_routing: record {
## Values extracted from an IPv6 Fragment extension header. ## Values extracted from an IPv6 Fragment extension header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
type ip6_fragment: record { type ip6_fragment: record {
## Protocol number of the next header (RFC 1700 et seq., IANA assigned ## Protocol number of the next header (RFC 1700 et seq., IANA assigned
## number), e.g. :bro:id:`IPPROTO_ICMP`. ## number), e.g. :bro:id:`IPPROTO_ICMP`.
@ -1038,7 +1038,7 @@ type ip6_fragment: record {
## Values extracted from an IPv6 Authentication extension header. ## Values extracted from an IPv6 Authentication extension header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
type ip6_ah: record { type ip6_ah: record {
## Protocol number of the next header (RFC 1700 et seq., IANA assigned ## Protocol number of the next header (RFC 1700 et seq., IANA assigned
## number), e.g. :bro:id:`IPPROTO_ICMP`. ## number), e.g. :bro:id:`IPPROTO_ICMP`.
@ -1057,7 +1057,7 @@ type ip6_ah: record {
## Values extracted from an IPv6 ESP extension header. ## Values extracted from an IPv6 ESP extension header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
type ip6_esp: record { type ip6_esp: record {
## Security Parameters Index. ## Security Parameters Index.
spi: count; spi: count;
@ -1067,7 +1067,7 @@ type ip6_esp: record {
## Values extracted from an IPv6 Mobility Binding Refresh Request message. ## Values extracted from an IPv6 Mobility Binding Refresh Request message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_brr: record { type ip6_mobility_brr: record {
## Reserved. ## Reserved.
rsv: count; rsv: count;
@ -1077,7 +1077,7 @@ type ip6_mobility_brr: record {
## Values extracted from an IPv6 Mobility Home Test Init message. ## Values extracted from an IPv6 Mobility Home Test Init message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_hoti: record { type ip6_mobility_hoti: record {
## Reserved. ## Reserved.
rsv: count; rsv: count;
@ -1089,7 +1089,7 @@ type ip6_mobility_hoti: record {
## Values extracted from an IPv6 Mobility Care-of Test Init message. ## Values extracted from an IPv6 Mobility Care-of Test Init message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_coti: record { type ip6_mobility_coti: record {
## Reserved. ## Reserved.
rsv: count; rsv: count;
@ -1101,7 +1101,7 @@ type ip6_mobility_coti: record {
## Values extracted from an IPv6 Mobility Home Test message. ## Values extracted from an IPv6 Mobility Home Test message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_hot: record { type ip6_mobility_hot: record {
## Home Nonce Index. ## Home Nonce Index.
nonce_idx: count; nonce_idx: count;
@ -1115,7 +1115,7 @@ type ip6_mobility_hot: record {
## Values extracted from an IPv6 Mobility Care-of Test message. ## Values extracted from an IPv6 Mobility Care-of Test message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_cot: record { type ip6_mobility_cot: record {
## Care-of Nonce Index. ## Care-of Nonce Index.
nonce_idx: count; nonce_idx: count;
@ -1129,7 +1129,7 @@ type ip6_mobility_cot: record {
## Values extracted from an IPv6 Mobility Binding Update message. ## Values extracted from an IPv6 Mobility Binding Update message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_bu: record { type ip6_mobility_bu: record {
## Sequence number. ## Sequence number.
seq: count; seq: count;
@ -1149,7 +1149,7 @@ type ip6_mobility_bu: record {
## Values extracted from an IPv6 Mobility Binding Acknowledgement message. ## Values extracted from an IPv6 Mobility Binding Acknowledgement message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_back: record { type ip6_mobility_back: record {
## Status. ## Status.
status: count; status: count;
@ -1165,7 +1165,7 @@ type ip6_mobility_back: record {
## Values extracted from an IPv6 Mobility Binding Error message. ## Values extracted from an IPv6 Mobility Binding Error message.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
type ip6_mobility_be: record { type ip6_mobility_be: record {
## Status. ## Status.
status: count; status: count;
@ -1177,7 +1177,7 @@ type ip6_mobility_be: record {
## Values extracted from an IPv6 Mobility header's message data. ## Values extracted from an IPv6 Mobility header's message data.
## ##
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr
type ip6_mobility_msg: record { type ip6_mobility_msg: record {
## The type of message from the header's MH Type field. ## The type of message from the header's MH Type field.
id: count; id: count;
@ -1201,7 +1201,7 @@ type ip6_mobility_msg: record {
## Values extracted from an IPv6 Mobility header. ## Values extracted from an IPv6 Mobility header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
type ip6_mobility_hdr: record { type ip6_mobility_hdr: record {
## Protocol number of the next header (RFC 1700 et seq., IANA assigned ## Protocol number of the next header (RFC 1700 et seq., IANA assigned
## number), e.g. :bro:id:`IPPROTO_ICMP`. ## number), e.g. :bro:id:`IPPROTO_ICMP`.
@ -1244,7 +1244,7 @@ type ip6_ext_hdr: record {
## Values extracted from an IPv6 header. ## Values extracted from an IPv6 header.
## ##
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr_chain ip6_hopopts ip6_dstopts ## .. bro:see:: pkt_hdr ip4_hdr ip6_ext_hdr ip6_hopopts ip6_dstopts
## ip6_routing ip6_fragment ip6_ah ip6_esp ## ip6_routing ip6_fragment ip6_ah ip6_esp
type ip6_hdr: record { type ip6_hdr: record {
class: count; ##< Traffic class. class: count; ##< Traffic class.

2
scripts/base/protocols/conn/main.bro
View file

@ -68,7 +68,7 @@ export {
missed_bytes: count &log &default=0; missed_bytes: count &log &default=0;
## Records the state history of connections as a string of letters. ## Records the state history of connections as a string of letters.
## For TCP connections the meaning of those letters is: ## The meaning of those letters is:
## ##
## ====== ==================================================== ## ====== ====================================================
## Letter Meaning ## Letter Meaning

210
src/bro.bif
View file

@ -963,7 +963,7 @@ function sha256_hash_finish%(index: any%): string
## Generates a random number. ## Generates a random number.
## ##
## max: The maximum value the random number. ## max: The maximum value of the random number.
## ##
## Returns: a random positive integer in the interval *[0, max)*. ## Returns: a random positive integer in the interval *[0, max)*.
## ##
@ -1020,7 +1020,7 @@ extern "C" {
## data: The data to find the MIME type for. ## data: The data to find the MIME type for.
## ##
## return_mime: If true, the function returns a short MIME type string (e.g., ## return_mime: If true, the function returns a short MIME type string (e.g.,
## ``text/plain`` instead of a more elaborate textual description. ## ``text/plain`` instead of a more elaborate textual description).
## ##
## Returns: The MIME type of *data*. ## Returns: The MIME type of *data*.
function identify_data%(data: string, return_mime: bool%): string function identify_data%(data: string, return_mime: bool%): string
@ -1241,8 +1241,6 @@ function unique_id_from%(pool: int, prefix: string%) : string
## Removes all elements from a set or table. ## Removes all elements from a set or table.
## ##
## v: The set or table ## v: The set or table
##
## Returns: The cleared set/table or 0 if *v* is not a set/table type.
function clear_table%(v: any%): any function clear_table%(v: any%): any
%{ %{
if ( v->Type()->Tag() == TYPE_TABLE ) if ( v->Type()->Tag() == TYPE_TABLE )
@ -1290,7 +1288,7 @@ function same_object%(o1: any, o2: any%): bool
return new Val(o1 == o2, TYPE_BOOL); return new Val(o1 == o2, TYPE_BOOL);
%} %}
## Returns the number bytes that a value occupies in memory. ## Returns the number of bytes that a value occupies in memory.
## ##
## v: The value ## v: The value
## ##
@ -1306,7 +1304,7 @@ function val_size%(v: any%): count
## ##
## newsize: The new size of *aggr*. ## newsize: The new size of *aggr*.
## ##
## Returns: The old size of *aggr* and 0 if *aggr* is not a :bro:type:`vector`. ## Returns: The old size of *aggr*, or 0 if *aggr* is not a :bro:type:`vector`.
function resize%(aggr: any, newsize: count%) : count function resize%(aggr: any, newsize: count%) : count
%{ %{
if ( aggr->Type()->Tag() != TYPE_VECTOR ) if ( aggr->Type()->Tag() != TYPE_VECTOR )
@ -1423,7 +1421,7 @@ bool indirect_int_sort_function(int a, int b)
%%} %%}
## Sorts a vector in place. The second argument is a comparison function that ## Sorts a vector in place. The second argument is a comparison function that
## takes two arguments: if the vector type is \verb|vector of T|, then the ## takes two arguments: if the vector type is ``vector of T``, then the
## comparison function must be ``function(a: T, b: T): bool``, which returns ## comparison function must be ``function(a: T, b: T): bool``, which returns
## ``a < b`` for some type-specific notion of the less-than operator. ## ``a < b`` for some type-specific notion of the less-than operator.
## ##
@ -1599,7 +1597,7 @@ function cat%(...%): string
## given argument. If any of the variable arguments is an empty string it is ## given argument. If any of the variable arguments is an empty string it is
## replaced by a given default string instead. ## replaced by a given default string instead.
## ##
## sep: The separator to place betwen each argument. ## sep: The separator to place between each argument.
## ##
## def: The default string to use when an argument is the empty string. ## def: The default string to use when an argument is the empty string.
## ##
@ -1657,7 +1655,7 @@ function cat_sep%(sep: string, def: string, ...%): string
## ##
## - ``[DT]``: ISO timestamp with microsecond precision ## - ``[DT]``: ISO timestamp with microsecond precision
## ##
## - ``d``: Signed/Unsigned integer (using C-style ``%lld|``/``%llu`` ## - ``d``: Signed/Unsigned integer (using C-style ``%lld``/``%llu``
## for ``int``/``count``) ## for ``int``/``count``)
## ##
## - ``x``: Unsigned hexadecimal (using C-style ``%llx``); ## - ``x``: Unsigned hexadecimal (using C-style ``%llx``);
@ -1782,7 +1780,7 @@ function log10%(d: double%): double
# =========================================================================== # ===========================================================================
## Determines whether *c* has been received externally. For example, ## Determines whether *c* has been received externally. For example,
## Broccoli or the Time Machine can send packets to Bro via a mechanism that ## Broccoli or the Time Machine can send packets to Bro via a mechanism that is
## one step lower than sending events. This function checks whether the packets ## one step lower than sending events. This function checks whether the packets
## of a connection stem from one of these external *packet sources*. ## of a connection stem from one of these external *packet sources*.
## ##
@ -1796,7 +1794,7 @@ function is_external_connection%(c: connection%) : bool
## Returns the ID of the analyzer which raised the current event. ## Returns the ID of the analyzer which raised the current event.
## ##
## Returns: The ID of the analyzer which raised hte current event, or 0 if ## Returns: The ID of the analyzer which raised the current event, or 0 if
## none. ## none.
function current_analyzer%(%) : count function current_analyzer%(%) : count
%{ %{
@ -2053,7 +2051,7 @@ function get_gap_summary%(%): gap_info
%} %}
## Generates a table of the size of all global variables. The table index is ## Generates a table of the size of all global variables. The table index is
## the variable name and the value the variable size in bytes. ## the variable name and the value is the variable size in bytes.
## ##
## Returns: A table that maps variable names to their sizes. ## Returns: A table that maps variable names to their sizes.
## ##
@ -2138,7 +2136,7 @@ function lookup_ID%(id: string%) : any
return i->ID_Val()->Ref(); return i->ID_Val()->Ref();
%} %}
## Generates meta data about a record fields. The returned information ## Generates metadata about a record's fields. The returned information
## includes the field name, whether it is logged, its value (if it has one), ## includes the field name, whether it is logged, its value (if it has one),
## and its default value (if specified). ## and its default value (if specified).
## ##
@ -2269,11 +2267,11 @@ function dump_rule_stats%(f: file%): bool
return new Val(1, TYPE_BOOL); return new Val(1, TYPE_BOOL);
%} %}
## Checks wheter Bro is terminating. ## Checks if Bro is terminating.
## ##
## Returns: True if Bro is in the process of shutting down. ## Returns: True if Bro is in the process of shutting down.
## ##
## .. bro:see: terminate ## .. bro:see:: terminate
function bro_is_terminating%(%): bool function bro_is_terminating%(%): bool
%{ %{
return new Val(terminating, TYPE_BOOL); return new Val(terminating, TYPE_BOOL);
@ -2354,7 +2352,7 @@ function routing0_data_to_addrs%(s: string%): addr_vec
return rval; return rval;
%} %}
## Converts a :bro:type:`addr` to a :bro:type:`index_vec`. ## Converts an :bro:type:`addr` to an :bro:type:`index_vec`.
## ##
## a: The address to convert into a vector of counts. ## a: The address to convert into a vector of counts.
## ##
@ -2374,7 +2372,7 @@ function addr_to_counts%(a: addr%): index_vec
return rval; return rval;
%} %}
## Converts a :bro:type:`index_vec` to a :bro:type:`addr`. ## Converts an :bro:type:`index_vec` to an :bro:type:`addr`.
## ##
## v: The vector containing host-order IP address representation, ## v: The vector containing host-order IP address representation,
## one element for IPv4 addresses, four elements for IPv6 addresses. ## one element for IPv4 addresses, four elements for IPv6 addresses.
@ -2404,7 +2402,7 @@ function counts_to_addr%(v: index_vec%): addr
} }
%} %}
## Converts a :bro:type:`string` to a :bro:type:`int`. ## Converts a :bro:type:`string` to an :bro:type:`int`.
## ##
## str: The :bro:type:`string` to convert. ## str: The :bro:type:`string` to convert.
## ##
@ -2434,7 +2432,7 @@ function to_int%(str: string%): int
## ##
## n: The :bro:type:`int` to convert. ## n: The :bro:type:`int` to convert.
## ##
## Returns: The :bro:type:`int` *n* as unsigned integer or 0 if *n* < 0. ## Returns: The :bro:type:`int` *n* as unsigned integer, or 0 if *n* < 0.
function int_to_count%(n: int%): count function int_to_count%(n: int%): count
%{ %{
if ( n < 0 ) if ( n < 0 )
@ -2449,7 +2447,7 @@ function int_to_count%(n: int%): count
## ##
## d: The :bro:type:`double` to convert. ## d: The :bro:type:`double` to convert.
## ##
## Returns: The :bro:type:`double` *d* as unsigned integer or 0 if *d* < 0.0. ## Returns: The :bro:type:`double` *d* as unsigned integer, or 0 if *d* < 0.0.
## ##
## .. bro:see:: double_to_time ## .. bro:see:: double_to_time
function double_to_count%(d: double%): count function double_to_count%(d: double%): count
@ -2464,8 +2462,8 @@ function double_to_count%(d: double%): count
## ##
## str: The :bro:type:`string` to convert. ## str: The :bro:type:`string` to convert.
## ##
## Returns: The :bro:type:`string` *str* as unsigned integer or if in invalid ## Returns: The :bro:type:`string` *str* as unsigned integer, or 0 if *str* has
## format. ## an invalid format.
## ##
## .. bro:see:: to_addr to_int to_port to_subnet ## .. bro:see:: to_addr to_int to_port to_subnet
function to_count%(str: string%): count function to_count%(str: string%): count
@ -2498,7 +2496,7 @@ function interval_to_double%(i: interval%): double
## Converts a :bro:type:`time` value to a :bro:type:`double`. ## Converts a :bro:type:`time` value to a :bro:type:`double`.
## ##
## t: The :bro:type:`interval` to convert. ## t: The :bro:type:`time` to convert.
## ##
## Returns: The :bro:type:`time` value *t* as :bro:type:`double`. ## Returns: The :bro:type:`time` value *t* as :bro:type:`double`.
## ##
@ -2508,11 +2506,11 @@ function time_to_double%(t: time%): double
return new Val(t, TYPE_DOUBLE); return new Val(t, TYPE_DOUBLE);
%} %}
## Converts a :bro:type:`time` value to a :bro:type:`double`. ## Converts a :bro:type:`double` value to a :bro:type:`time`.
## ##
## t: The :bro:type:`interval` to convert. ## d: The :bro:type:`double` to convert.
## ##
## Returns: The :bro:type:`time` value *t* as :bro:type:`double`. ## Returns: The :bro:type:`double` value *d* as :bro:type:`time`.
## ##
## .. bro:see:: time_to_double double_to_count ## .. bro:see:: time_to_double double_to_count
function double_to_time%(d: double%): time function double_to_time%(d: double%): time
@ -2550,7 +2548,7 @@ function port_to_count%(p: port%): count
## ##
## proto: The transport protocol. ## proto: The transport protocol.
## ##
## Returns: The :bro:type:`count` *c* as :bro:type:`port`. ## Returns: The :bro:type:`count` *num* as :bro:type:`port`.
## ##
## .. bro:see:: port_to_count ## .. bro:see:: port_to_count
function count_to_port%(num: count, proto: transport_proto%): port function count_to_port%(num: count, proto: transport_proto%): port
@ -2562,7 +2560,7 @@ function count_to_port%(num: count, proto: transport_proto%): port
## ##
## ip: The :bro:type:`string` to convert. ## ip: The :bro:type:`string` to convert.
## ##
## Returns: The :bro:type:`string` *ip* as :bro:type:`addr` or the unspecified ## Returns: The :bro:type:`string` *ip* as :bro:type:`addr`, or the unspecified
## address ``::`` if the input string does not parse correctly. ## address ``::`` if the input string does not parse correctly.
## ##
## .. bro:see:: to_count to_int to_port count_to_v4_addr raw_bytes_to_v4_addr ## .. bro:see:: to_count to_int to_port count_to_v4_addr raw_bytes_to_v4_addr
@ -2579,7 +2577,7 @@ function to_addr%(ip: string%): addr
## ##
## sn: The subnet to convert. ## sn: The subnet to convert.
## ##
## Returns: The *sn* string as a :bro:type:`subnet` or the unspecified subnet ## Returns: The *sn* string as a :bro:type:`subnet`, or the unspecified subnet
## ``::/0`` if the input string does not parse correctly. ## ``::/0`` if the input string does not parse correctly.
## ##
## .. bro:see:: to_count to_int to_port count_to_v4_addr raw_bytes_to_v4_addr ## .. bro:see:: to_count to_int to_port count_to_v4_addr raw_bytes_to_v4_addr
@ -2616,7 +2614,7 @@ function count_to_v4_addr%(ip: count%): addr
## ##
## b: The raw bytes (:bro:type:`string`) to convert. ## b: The raw bytes (:bro:type:`string`) to convert.
## ##
## Returns: The byte :bro:type:`string` *ip* as :bro:type:`addr`. ## Returns: The byte :bro:type:`string` *b* as :bro:type:`addr`.
## ##
## .. bro:see:: raw_bytes_to_v4_addr to_addr to_subnet ## .. bro:see:: raw_bytes_to_v4_addr to_addr to_subnet
function raw_bytes_to_v4_addr%(b: string%): addr function raw_bytes_to_v4_addr%(b: string%): addr
@ -2635,7 +2633,7 @@ function raw_bytes_to_v4_addr%(b: string%): addr
return new AddrVal(htonl(a)); return new AddrVal(htonl(a));
%} %}
## Converts a :bro:type:`string` to an :bro:type:`port`. ## Converts a :bro:type:`string` to a :bro:type:`port`.
## ##
## s: The :bro:type:`string` to convert. ## s: The :bro:type:`string` to convert.
## ##
@ -2885,7 +2883,7 @@ function parse_ftp_port%(s: string%): ftp_port
%} %}
## Converts a string representation of the FTP EPRT command to an ``ftp_port``. ## Converts a string representation of the FTP EPRT command to an ``ftp_port``.
## (see `RFC 2428 <http://tools.ietf.org/html/rfc2428>`_). ## See `RFC 2428 <http://tools.ietf.org/html/rfc2428>`_.
## The format is ``EPRT<space><d><net-prt><d><net-addr><d><tcp-port><d>``, ## The format is ``EPRT<space><d><net-prt><d><net-addr><d><tcp-port><d>``,
## where ``<d>`` is a delimiter in the ASCII range 33-126 (usually ``|``). ## where ``<d>`` is a delimiter in the ASCII range 33-126 (usually ``|``).
## ##
@ -2976,7 +2974,7 @@ function fmt_ftp_port%(a: addr, p: port%): string
## Decode a NetBIOS name. See http://support.microsoft.com/kb/194203. ## Decode a NetBIOS name. See http://support.microsoft.com/kb/194203.
## ##
## name: The encoded NetBIOS name, e.g., ``"FEEIEFCAEOEFFEECEJEPFDCAEOEBENEF:``. ## name: The encoded NetBIOS name, e.g., ``"FEEIEFCAEOEFFEECEJEPFDCAEOEBENEF"``.
## ##
## Returns: The decoded NetBIOS name, e.g., ``"THE NETBIOS NAME"``. ## Returns: The decoded NetBIOS name, e.g., ``"THE NETBIOS NAME"``.
## ##
@ -3009,7 +3007,7 @@ function decode_netbios_name%(name: string%): string
return new StringVal(i, result); return new StringVal(i, result);
%} %}
## Converts a NetBIOS name type to its corresonding numeric value. ## Converts a NetBIOS name type to its corresponding numeric value.
## See http://support.microsoft.com/kb/163409. ## See http://support.microsoft.com/kb/163409.
## ##
## name: The NetBIOS name type. ## name: The NetBIOS name type.
@ -3029,7 +3027,7 @@ function decode_netbios_name_type%(name: string%): count
## ##
## bytestring: The string of bytes. ## bytestring: The string of bytes.
## ##
## Returns: The hexadecimal reprsentation of *bytestring*. ## Returns: The hexadecimal representation of *bytestring*.
## ##
## .. bro:see:: hexdump ## .. bro:see:: hexdump
function bytestring_to_hexstr%(bytestring: string%): string function bytestring_to_hexstr%(bytestring: string%): string
@ -3069,7 +3067,7 @@ function decode_base64%(s: string%): string
## s: The Base64-encoded string. ## s: The Base64-encoded string.
## ##
## a: The custom alphabet. The empty string indicates the default alphabet. The ## a: The custom alphabet. The empty string indicates the default alphabet. The
## lengh of *a* must bt 64. For example, a custom alphabet could be ## length of *a* must be 64. For example, a custom alphabet could be
## ``"!#$%&/(),-.:;<>@[]^ `_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?"``. ## ``"!#$%&/(),-.:;<>@[]^ `_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?"``.
## ##
## Returns: The decoded version of *s*. ## Returns: The decoded version of *s*.
@ -3138,7 +3136,7 @@ function uuid_to_string%(uuid: string%): string
## ##
## p2: The second pattern. ## p2: The second pattern.
## ##
## Returns: The compiled pattern of the concatentation of *p1* and *p2*. ## Returns: The compiled pattern of the concatenation of *p1* and *p2*.
## ##
## .. bro:see:: convert_for_pattern string_to_pattern ## .. bro:see:: convert_for_pattern string_to_pattern
## ##
@ -3277,7 +3275,7 @@ function strftime%(fmt: string, d: time%) : string
## a: The address to mask. ## a: The address to mask.
## ##
## top_bits_to_keep: The number of top bits to keep in *a*; must be greater ## top_bits_to_keep: The number of top bits to keep in *a*; must be greater
## than 0 and less than 33. ## than 0 and less than 33 for IPv4, or 129 for IPv6.
## ##
## Returns: The address *a* masked down to *top_bits_to_keep* bits. ## Returns: The address *a* masked down to *top_bits_to_keep* bits.
## ##
@ -3341,7 +3339,7 @@ function is_udp_port%(p: port%): bool
## ##
## p: The :bro:type:`port` to check. ## p: The :bro:type:`port` to check.
## ##
## Returns: True iff *p* is a ICMP port. ## Returns: True iff *p* is an ICMP port.
## ##
## .. bro:see:: is_tcp_port is_udp_port ## .. bro:see:: is_tcp_port is_udp_port
function is_icmp_port%(p: port%): bool function is_icmp_port%(p: port%): bool
@ -3383,7 +3381,7 @@ EnumVal* map_conn_type(TransportProto tp)
## ##
## cid: The connection identifier. ## cid: The connection identifier.
## ##
## Returns: The transport protocol of the connection identified by *id*. ## Returns: The transport protocol of the connection identified by *cid*.
## ##
## .. bro:see:: get_port_transport_proto ## .. bro:see:: get_port_transport_proto
## get_orig_seq get_resp_seq ## get_orig_seq get_resp_seq
@ -3497,7 +3495,7 @@ const char* conn_id_string(Val* c)
## ##
## c: The HTTP connection. ## c: The HTTP connection.
## ##
## is_orig: If true, the client data is skipped and the server data otherwise. ## is_orig: If true, the client data is skipped, and the server data otherwise.
## ##
## .. bro:see:: skip_smtp_data ## .. bro:see:: skip_smtp_data
function skip_http_entity_data%(c: connection, is_orig: bool%): any function skip_http_entity_data%(c: connection, is_orig: bool%): any
@ -3572,7 +3570,7 @@ function dump_current_packet%(file_name: string%) : bool
## Returns the currently processed PCAP packet. ## Returns the currently processed PCAP packet.
## ##
## Returns: The currently processed packet, which is as a record ## Returns: The currently processed packet, which is a record
## containing the timestamp, ``snaplen``, and packet data. ## containing the timestamp, ``snaplen``, and packet data.
## ##
## .. bro:see:: dump_current_packet dump_packet send_current_packet ## .. bro:see:: dump_current_packet dump_packet send_current_packet
@ -3730,7 +3728,7 @@ function lookup_addr%(host: addr%) : string
## ##
## host: The hostname to lookup. ## host: The hostname to lookup.
## ##
## Returns: A set of DNS A records associated with *host*. ## Returns: A set of DNS A and AAAA records associated with *host*.
## ##
## .. bro:see:: lookup_addr ## .. bro:see:: lookup_addr
function lookup_hostname%(host: string%) : addr_set function lookup_hostname%(host: string%) : addr_set
@ -3897,6 +3895,7 @@ function lookup_location%(a: addr%) : geo_location
%} %}
## Performs an AS lookup of an IP address. ## Performs an AS lookup of an IP address.
## Requires Bro to be built with ``libgeoip``.
## ##
## a: The IP address to lookup. ## a: The IP address to lookup.
## ##
@ -4096,7 +4095,7 @@ function x509_err2str%(err_num: count%): string
## Converts UNIX file permissions given by a mode to an ASCII string. ## Converts UNIX file permissions given by a mode to an ASCII string.
## ##
## mode: The permisssions, e.g., 644 or 755. ## mode: The permissions (an octal number like 0644 converted to decimal).
## ##
## Returns: A string representation of *mode* in the format ## Returns: A string representation of *mode* in the format
## ``rw[xsS]rw[xsS]rw[xtT]``. ## ``rw[xsS]rw[xsS]rw[xtT]``.
@ -4273,7 +4272,7 @@ function analyzer_name%(aid: count%) : string
## ##
## cid: The connection ID. ## cid: The connection ID.
## ##
## Returns: False if *id* does not point to an active connection and true ## Returns: False if *cid* does not point to an active connection, and true
## otherwise. ## otherwise.
## ##
## .. note:: ## .. note::
@ -4295,10 +4294,10 @@ function skip_further_processing%(cid: conn_id%): bool
## ##
## cid: The connection identifier. ## cid: The connection identifier.
## ##
## do_record: True to enable packet contens and false to disable for the ## do_record: True to enable packet contents, and false to disable for the
## connection identified by *cid*. ## connection identified by *cid*.
## ##
## Returns: False if *id* does not point to an active connection and true ## Returns: False if *cid* does not point to an active connection, and true
## otherwise. ## otherwise.
## ##
## .. bro:see:: skip_further_processing ## .. bro:see:: skip_further_processing
@ -4309,7 +4308,7 @@ function skip_further_processing%(cid: conn_id%): bool
## connection, which is controlled separately by ## connection, which is controlled separately by
## :bro:id:`skip_further_processing`. ## :bro:id:`skip_further_processing`.
## ##
## .. bro:see: get_contents_file set_contents_file ## .. bro:see:: get_contents_file set_contents_file
function set_record_packets%(cid: conn_id, do_record: bool%): bool function set_record_packets%(cid: conn_id, do_record: bool%): bool
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = sessions->FindConnection(cid);
@ -4326,7 +4325,7 @@ function set_record_packets%(cid: conn_id, do_record: bool%): bool
## cid: The connection ID. ## cid: The connection ID.
## ##
## direction: Controls what sides of the connection to record. The argument can ## direction: Controls what sides of the connection to record. The argument can
## take one the four values: ## take one of the four values:
## ##
## - ``CONTENTS_NONE``: Stop recording the connection's content. ## - ``CONTENTS_NONE``: Stop recording the connection's content.
## - ``CONTENTS_ORIG``: Record the data sent by the connection ## - ``CONTENTS_ORIG``: Record the data sent by the connection
@ -4340,7 +4339,7 @@ function set_record_packets%(cid: conn_id, do_record: bool%): bool
## ##
## f: The file handle of the file to write the contents to. ## f: The file handle of the file to write the contents to.
## ##
## Returns: Returns false if *id* does not point to an active connection and ## Returns: Returns false if *cid* does not point to an active connection, and
## true otherwise. ## true otherwise.
## ##
## .. note:: ## .. note::
@ -4351,7 +4350,7 @@ function set_record_packets%(cid: conn_id, do_record: bool%): bool
## missing data; this can happen, e.g., due to an ## missing data; this can happen, e.g., due to an
## :bro:id:`ack_above_hole` event. ## :bro:id:`ack_above_hole` event.
## ##
## .. bro:see: get_contents_file set_record_packets ## .. bro:see:: get_contents_file set_record_packets
function set_contents_file%(cid: conn_id, direction: count, f: file%): bool function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = sessions->FindConnection(cid);
@ -4366,15 +4365,15 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
## ##
## cid: The connection ID. ## cid: The connection ID.
## ##
## direction: Controls what sides of the connection to record. SEe ## direction: Controls what sides of the connection to record. See
## :bro:id:`set_contents_file` for possible values. ## :bro:id:`set_contents_file` for possible values.
## ##
## Returns: The :bro:type:`file` handle for the contentents file of the ## Returns: The :bro:type:`file` handle for the contents file of the
## connection identified by *cid*. If the connection exists ## connection identified by *cid*. If the connection exists
## but no contents file for *direction*, the function generates a ## but there is no contents file for *direction*, then the function
## error and returns a file handle to ``stderr``. ## generates an error and returns a file handle to ``stderr``.
## ##
## .. bro:see: set_contents_file set_record_packets ## .. bro:see:: set_contents_file set_record_packets
function get_contents_file%(cid: conn_id, direction: count%): file function get_contents_file%(cid: conn_id, direction: count%): file
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = sessions->FindConnection(cid);
@ -4425,7 +4424,7 @@ function set_inactivity_timeout%(cid: conn_id, t: interval%): interval
## ##
## - ``LOGIN_STATE_AUTHENTICATE``: The connection is in its ## - ``LOGIN_STATE_AUTHENTICATE``: The connection is in its
## initial authentication dialog. ## initial authentication dialog.
## - ``OGIN_STATE_LOGGED_IN``: The analyzer believes the user has ## - ``LOGIN_STATE_LOGGED_IN``: The analyzer believes the user has
## successfully authenticated. ## successfully authenticated.
## - ``LOGIN_STATE_SKIP``: The analyzer has skipped any further ## - ``LOGIN_STATE_SKIP``: The analyzer has skipped any further
## processing of the connection. ## processing of the connection.
@ -4433,7 +4432,7 @@ function set_inactivity_timeout%(cid: conn_id, t: interval%): interval
## does not correctly know the state of the connection, and/or ## does not correctly know the state of the connection, and/or
## the username associated with it. ## the username associated with it.
## ##
## .. bro:see: set_login_state ## .. bro:see:: set_login_state
function get_login_state%(cid: conn_id%): count function get_login_state%(cid: conn_id%): count
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = sessions->FindConnection(cid);
@ -4456,9 +4455,9 @@ function get_login_state%(cid: conn_id%): count
## :bro:id:`get_login_state` for possible values. ## :bro:id:`get_login_state` for possible values.
## ##
## Returns: Returns false if *cid* is not an active connection ## Returns: Returns false if *cid* is not an active connection
## or does not tagged as login analyzer, and true otherwise. ## or is not tagged as a login analyzer, and true otherwise.
## ##
## .. bro:see: get_login_state ## .. bro:see:: get_login_state
function set_login_state%(cid: conn_id, new_state: count%): bool function set_login_state%(cid: conn_id, new_state: count%): bool
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = sessions->FindConnection(cid);
@ -4590,9 +4589,9 @@ function disable_event_group%(group: string%) : any
## ##
## f: The path to the file. ## f: The path to the file.
## ##
## Returns: A :bro:type:`file` handle for subsequent operations. ## Returns: A :bro:type:`file` handle for subsequent operations.
## ##
## .. bro:see;: active_file open_for_append close write_file ## .. bro:see:: active_file open_for_append close write_file
## get_file_name set_buf flush_all mkdir enable_raw_output ## get_file_name set_buf flush_all mkdir enable_raw_output
function open%(f: string%): file function open%(f: string%): file
%{ %{
@ -4609,9 +4608,9 @@ function open%(f: string%): file
## ##
## f: The path to the file. ## f: The path to the file.
## ##
## Returns: A :bro:type:`file` handle for subsequent operations. ## Returns: A :bro:type:`file` handle for subsequent operations.
## ##
## .. bro:see;: active_file open close write_file ## .. bro:see:: active_file open close write_file
## get_file_name set_buf flush_all mkdir enable_raw_output ## get_file_name set_buf flush_all mkdir enable_raw_output
function open_for_append%(f: string%): file function open_for_append%(f: string%): file
%{ %{
@ -4619,13 +4618,12 @@ function open_for_append%(f: string%): file
%} %}
## Closes an open file and flushes any buffered content. ## Closes an open file and flushes any buffered content.
## exists, this function appends to it (as opposed to :bro:id:`open`).
## ##
## f: A :bro:type:`file` handle to an open file. ## f: A :bro:type:`file` handle to an open file.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
## .. bro:see;: active_file open open_for_append write_file ## .. bro:see:: active_file open open_for_append write_file
## get_file_name set_buf flush_all mkdir enable_raw_output ## get_file_name set_buf flush_all mkdir enable_raw_output
function close%(f: file%): bool function close%(f: file%): bool
%{ %{
@ -4638,9 +4636,9 @@ function close%(f: file%): bool
## ##
## data: The data to write to *f*. ## data: The data to write to *f*.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
## .. bro:see;: active_file open open_for_append close ## .. bro:see:: active_file open open_for_append close
## get_file_name set_buf flush_all mkdir enable_raw_output ## get_file_name set_buf flush_all mkdir enable_raw_output
function write_file%(f: file, data: string%): bool function write_file%(f: file, data: string%): bool
%{ %{
@ -4656,11 +4654,11 @@ function write_file%(f: file, data: string%): bool
## f: A :bro:type:`file` handle to an open file. ## f: A :bro:type:`file` handle to an open file.
## ##
## buffered: When true, *f* is fully buffered, i.e., bytes are saved in a ## buffered: When true, *f* is fully buffered, i.e., bytes are saved in a
## buffered until the block size has been reached. When ## buffer until the block size has been reached. When
## false, *f* is line buffered, i.e., bytes are saved up until a ## false, *f* is line buffered, i.e., bytes are saved up until a
## newline occurs. ## newline occurs.
## ##
## .. bro:see;: active_file open open_for_append close ## .. bro:see:: active_file open open_for_append close
## get_file_name write_file flush_all mkdir enable_raw_output ## get_file_name write_file flush_all mkdir enable_raw_output
function set_buf%(f: file, buffered: bool%): any function set_buf%(f: file, buffered: bool%): any
%{ %{
@ -4670,9 +4668,9 @@ function set_buf%(f: file, buffered: bool%): any
## Flushes all open files to disk. ## Flushes all open files to disk.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
## .. bro:see;: active_file open open_for_append close ## .. bro:see:: active_file open open_for_append close
## get_file_name write_file set_buf mkdir enable_raw_output ## get_file_name write_file set_buf mkdir enable_raw_output
function flush_all%(%): bool function flush_all%(%): bool
%{ %{
@ -4683,10 +4681,10 @@ function flush_all%(%): bool
## ##
## f: The directory name. ## f: The directory name.
## ##
## Returns: Returns true if the operation succeeds and false if the ## Returns: Returns true if the operation succeeds, or false if the
## creation fails or if *f* exists already. ## creation fails or if *f* exists already.
## ##
## .. bro:see;: active_file open_for_append close write_file ## .. bro:see:: active_file open_for_append close write_file
## get_file_name set_buf flush_all enable_raw_output ## get_file_name set_buf flush_all enable_raw_output
function mkdir%(f: string%): bool function mkdir%(f: string%): bool
%{ %{
@ -4731,7 +4729,7 @@ function get_file_name%(f: file%): string
## ##
## f: An open file handle. ## f: An open file handle.
## ##
## Returns: Rotations statistics which include the original file name, the name ## Returns: Rotation statistics which include the original file name, the name
## after the rotation, and the time when *f* was opened/closed. ## after the rotation, and the time when *f* was opened/closed.
## ##
## .. bro:see:: rotate_file_by_name calc_next_rotate ## .. bro:see:: rotate_file_by_name calc_next_rotate
@ -4755,7 +4753,7 @@ function rotate_file%(f: file%): rotate_info
## ##
## f: The name of the file to rotate ## f: The name of the file to rotate
## ##
## Returns: Rotations statistics which include the original file name, the name ## Returns: Rotation statistics which include the original file name, the name
## after the rotation, and the time when *f* was opened/closed. ## after the rotation, and the time when *f* was opened/closed.
## ##
## .. bro:see:: rotate_file calc_next_rotate ## .. bro:see:: rotate_file calc_next_rotate
@ -4851,7 +4849,7 @@ function disable_print_hook%(f: file%): any
return 0; return 0;
%} %}
## Prevents escaping of non-ASCII character when writing to a file. ## Prevents escaping of non-ASCII characters when writing to a file.
## This function is equivalent to :bro:attr:`&disable_print_hook`. ## This function is equivalent to :bro:attr:`&disable_print_hook`.
## ##
## f: The file to disable raw output for. ## f: The file to disable raw output for.
@ -5213,9 +5211,9 @@ function checkpoint_state%(%) : bool
return new Val(persistence_serializer->WriteState(true), TYPE_BOOL); return new Val(persistence_serializer->WriteState(true), TYPE_BOOL);
%} %}
## Reads persistent state from the \texttt{.state} directory and populates the ## Reads persistent state and populates the in-memory data structures
## in-memory data structures accordingly. This function is the dual to ## accordingly. Persistent state is read from the ``.state`` directory.
## :bro:id:`checkpoint_state`. ## This function is the dual to :bro:id:`checkpoint_state`.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
@ -5267,16 +5265,16 @@ function capture_state_updates%(filename: string%) : bool
## ##
## ip: The IP address of the remote peer. ## ip: The IP address of the remote peer.
## ##
## port: The port of the remote peer. ## p: The port of the remote peer.
## ##
## our_class: If an non-empty string, the remote (listening) peer checks it ## our_class: If a non-empty string, then the remote (listening) peer checks it
## against its class name in its peer table and terminates the ## against its class name in its peer table and terminates the
## connection if they don't match. ## connection if they don't match.
## ##
## retry: If the connection fails, try to reconnect with the peer after this ## retry: If the connection fails, try to reconnect with the peer after this
## time interval. ## time interval.
## ##
## ssl: If true, uses SSL to encrypt the session. ## ssl: If true, use SSL to encrypt the session.
## ##
## Returns: A locally unique ID of the new peer. ## Returns: A locally unique ID of the new peer.
## ##
@ -5299,7 +5297,7 @@ function connect%(ip: addr, p: port, our_class: string, retry: interval, ssl: bo
## Terminate the connection with a peer. ## Terminate the connection with a peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
@ -5313,7 +5311,7 @@ function disconnect%(p: event_peer%) : bool
## Subscribes to all events from a remote peer whose names match a given ## Subscribes to all events from a remote peer whose names match a given
## pattern. ## pattern.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## handlers: The pattern describing the events to request from peer *p*. ## handlers: The pattern describing the events to request from peer *p*.
## ##
@ -5331,7 +5329,7 @@ function request_remote_events%(p: event_peer, handlers: pattern%) : bool
## Requests synchronization of IDs with a remote peer. ## Requests synchronization of IDs with a remote peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## auth: If true, the local instance considers its current state authoritative ## auth: If true, the local instance considers its current state authoritative
## and sends it to *p* right after the handshake. ## and sends it to *p* right after the handshake.
@ -5349,7 +5347,7 @@ function request_remote_sync%(p: event_peer, auth: bool%) : bool
## Requests logs from a remote peer. ## Requests logs from a remote peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
@ -5361,9 +5359,11 @@ function request_remote_logs%(p: event_peer%) : bool
return new Val(remote_serializer->RequestLogs(id), TYPE_BOOL); return new Val(remote_serializer->RequestLogs(id), TYPE_BOOL);
%} %}
## Sets a boolean flag whether Bro accepts state from a remote peer. ## Sets a boolean flag indicating whether Bro accepts state from a remote peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
##
## accept: True if Bro accepts state from peer *p*, or false otherwise.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
@ -5379,7 +5379,7 @@ function set_accept_state%(p: event_peer, accept: bool%) : bool
## Sets the compression level of the session with a remote peer. ## Sets the compression level of the session with a remote peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## level: Allowed values are in the range *[0, 9]*, where 0 is the default and ## level: Allowed values are in the range *[0, 9]*, where 0 is the default and
## means no compression. ## means no compression.
@ -5394,11 +5394,11 @@ function set_compression_level%(p: event_peer, level: count%) : bool
TYPE_BOOL); TYPE_BOOL);
%} %}
## Listens on address a given IP address and port for remote connections. ## Listens on a given IP address and port for remote connections.
## ##
## ip: The IP address to bind to. ## ip: The IP address to bind to.
## ##
## p: The TCP port to listen to. ## p: The TCP port to listen on.
## ##
## ssl: If true, Bro uses SSL to encrypt the session. ## ssl: If true, Bro uses SSL to encrypt the session.
## ##
@ -5420,7 +5420,7 @@ function is_remote_event%(%) : bool
## Sends all persistent state to a remote peer. ## Sends all persistent state to a remote peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## Returns: True on success. ## Returns: True on success.
## ##
@ -5431,10 +5431,10 @@ function send_state%(p: event_peer%) : bool
return new Val(persistence_serializer->SendState(id, true), TYPE_BOOL); return new Val(persistence_serializer->SendState(id, true), TYPE_BOOL);
%} %}
## Sends a global identifier to a remote peer, which them might install it ## Sends a global identifier to a remote peer, which then might install it
## locally. ## locally.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## id: The identifier to send. ## id: The identifier to send.
## ##
@ -5468,7 +5468,7 @@ function terminate_communication%(%) : bool
## Signals a remote peer that the local Bro instance finished the initial ## Signals a remote peer that the local Bro instance finished the initial
## handshake. ## handshake.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## Returns: True on success. ## Returns: True on success.
function complete_handshake%(p: event_peer%) : bool function complete_handshake%(p: event_peer%) : bool
@ -5481,7 +5481,7 @@ function complete_handshake%(p: event_peer%) : bool
## for :bro:id:`remote_pong`, this function can be used to measure latency ## for :bro:id:`remote_pong`, this function can be used to measure latency
## between two peers. ## between two peers.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## seq: A sequence number (also included by :bro:id:`remote_pong`). ## seq: A sequence number (also included by :bro:id:`remote_pong`).
## ##
@ -5496,7 +5496,7 @@ function send_ping%(p: event_peer, seq: count%) : bool
## Sends the currently processed packet to a remote peer. ## Sends the currently processed packet to a remote peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## Returns: True if sending the packet succeeds. ## Returns: True if sending the packet succeeds.
## ##
@ -5522,7 +5522,7 @@ function send_current_packet%(p: event_peer%) : bool
## Returns the peer who generated the last event. ## Returns the peer who generated the last event.
## ##
## Returns: The ID of the peer who genereated the last event. ## Returns: The ID of the peer who generated the last event.
## ##
## .. bro:see:: get_local_event_peer ## .. bro:see:: get_local_event_peer
function get_event_peer%(%) : event_peer function get_event_peer%(%) : event_peer
@ -5565,7 +5565,7 @@ function get_local_event_peer%(%) : event_peer
## Sends a capture filter to a remote peer. ## Sends a capture filter to a remote peer.
## ##
## p: The peer ID return from :bro:id:`connect`. ## p: The peer ID returned from :bro:id:`connect`.
## ##
## s: The capture filter. ## s: The capture filter.
## ##
@ -5582,7 +5582,7 @@ function send_capture_filter%(p: event_peer, s: string%) : bool
## distributed trace processing with communication enabled ## distributed trace processing with communication enabled
## (*pseudo-realtime* mode). ## (*pseudo-realtime* mode).
## ##
## .. bro:see: continue_processing suspend_state_updates resume_state_updates ## .. bro:see:: continue_processing suspend_state_updates resume_state_updates
function suspend_processing%(%) : any function suspend_processing%(%) : any
%{ %{
net_suspend_processing(); net_suspend_processing();
@ -5591,7 +5591,7 @@ function suspend_processing%(%) : any
## Resumes Bro's packet processing. ## Resumes Bro's packet processing.
## ##
## .. bro:see: suspend_processing suspend_state_updates resume_state_updates ## .. bro:see:: suspend_processing suspend_state_updates resume_state_updates
function continue_processing%(%) : any function continue_processing%(%) : any
%{ %{
net_continue_processing(); net_continue_processing();
@ -5600,7 +5600,7 @@ function continue_processing%(%) : any
## Stops propagating :bro:attr:`&synchronized` accesses. ## Stops propagating :bro:attr:`&synchronized` accesses.
## ##
## .. bro:see: suspend_processing continue_processing resume_state_updates ## .. bro:see:: suspend_processing continue_processing resume_state_updates
function suspend_state_updates%(%) : any function suspend_state_updates%(%) : any
%{ %{
if ( remote_serializer ) if ( remote_serializer )
@ -5610,7 +5610,7 @@ function suspend_state_updates%(%) : any
## Resumes propagating :bro:attr:`&synchronized` accesses. ## Resumes propagating :bro:attr:`&synchronized` accesses.
## ##
## .. bro:see: suspend_processing continue_processing suspend_state_updates ## .. bro:see:: suspend_processing continue_processing suspend_state_updates
function resume_state_updates%(%) : any function resume_state_updates%(%) : any
%{ %{
if ( remote_serializer ) if ( remote_serializer )

9
src/event.bif
View file

@ -171,8 +171,11 @@ event new_connection_contents%(c: connection%);
## new_connection new_connection_contents partial_connection ## new_connection new_connection_contents partial_connection
event connection_attempt%(c: connection%); event connection_attempt%(c: connection%);
## Generated for an established TCP connection. The event is raised when the ## Generated when a SYN-ACK packet is seen in response to SYN a packet during
## initial 3-way TCP handshake has successfully finished for a connection. ## a TCP handshake. The final ACK of the handshake in response to SYN-ACK may
## or may not occur later, one way to tell is to check the *history* field of
## :bro:type:`connection` to see if the originator sent an ACK, indicated by
## 'A' in the history string.
## ##
## c: The connection. ## c: The connection.
## ##
@ -335,8 +338,6 @@ event connection_SYN_packet%(c: connection, pkt: SYN_packet%);
## ##
## c: The connection. ## c: The connection.
## ##
## pkt: Information extracted from the SYN packet.
##
## .. bro:see:: connection_EOF connection_SYN_packet connection_attempt ## .. bro:see:: connection_EOF connection_SYN_packet connection_attempt
## connection_established connection_external connection_finished ## connection_established connection_external connection_finished
## connection_half_finished connection_partial_close connection_pending ## connection_half_finished connection_partial_close connection_pending

50
src/strings.bif
View file

@ -11,8 +11,8 @@ using namespace std;
%%} %%}
## Concates all arguments into a single string. The function takes a variable ## Concatenates all arguments into a single string. The function takes a
## number of arguments of type string and stiches them together. ## variable number of arguments of type string and stitches them together.
## ##
## Returns: The concatenation of all (string) arguments. ## Returns: The concatenation of all (string) arguments.
## ##
@ -157,9 +157,9 @@ function join_string_array%(sep: string, a: string_array%): string
## ##
## sep: The separator to place between each element. ## sep: The separator to place between each element.
## ##
## a: The :bro:type:`string_vec` (``vector of string``). ## vec: The :bro:type:`string_vec` (``vector of string``).
## ##
## Returns: The concatenation of all elements in *a*, with *sep* placed ## Returns: The concatenation of all elements in *vec*, with *sep* placed
## between each element. ## between each element.
## ##
## .. bro:see:: cat cat_sep string_cat cat_string_array cat_string_array_n ## .. bro:see:: cat cat_sep string_cat cat_string_array cat_string_array_n
@ -219,7 +219,7 @@ function sort_string_array%(a: string_array%): string_array
## Returns an edited version of a string that applies a special ## Returns an edited version of a string that applies a special
## "backspace character" (usually ``\x08`` for backspace or ``\x7f`` for DEL). ## "backspace character" (usually ``\x08`` for backspace or ``\x7f`` for DEL).
## For ## example, ``edit("hello there", "e")`` returns ``"llo t"``. ## For example, ``edit("hello there", "e")`` returns ``"llo t"``.
## ##
## arg_s: The string to edit. ## arg_s: The string to edit.
## ##
@ -229,7 +229,7 @@ function sort_string_array%(a: string_array%): string_array
## the string. ## the string.
## ##
## Returns: An edited version of *arg_s* where *arg_edit_char* triggers the ## Returns: An edited version of *arg_s* where *arg_edit_char* triggers the
## deletetion of the last character. ## deletion of the last character.
## ##
## .. bro:see:: clean ## .. bro:see:: clean
## to_string_literal ## to_string_literal
@ -278,7 +278,7 @@ function byte_len%(s: string%): count
return new Val(s->Len(), TYPE_COUNT); return new Val(s->Len(), TYPE_COUNT);
%} %}
## Get a substring of from a string, given a starting position length. ## Get a substring from a string, given a starting position and length.
## ##
## s: The string to obtain a substring from. ## s: The string to obtain a substring from.
## ##
@ -486,10 +486,10 @@ function split%(str: string, re: pattern%): string_array
return do_split(str, re, 0, 0, 0); return do_split(str, re, 0, 0, 0);
%} %}
## Splits a string *once* into a a two-element array of strings according to a ## Splits a string *once* into a two-element array of strings according to a
## pattern. This function is the same as :bro:id:`split`, but * is only split ## pattern. This function is the same as :bro:id:`split`, but *str* is only
## once (if possible) at the earliest position and an array of two strings is ## split once (if possible) at the earliest position and an array of two strings
## returned. ## is returned.
## ##
## str: The string to split. ## str: The string to split.
## ##
@ -518,7 +518,7 @@ function split1%(str: string, re: pattern%): string_array
## ##
## Returns: An array of strings where each two successive elements correspond ## Returns: An array of strings where each two successive elements correspond
## to a substring in *str* of the part not matching *re* (odd-indexed) ## to a substring in *str* of the part not matching *re* (odd-indexed)
## and thei part that matches *re* (even-indexed). ## and the part that matches *re* (even-indexed).
## ##
## .. bro:see:: split split1 split_n str_split ## .. bro:see:: split split1 split_n str_split
function split_all%(str: string, re: pattern%): string_array function split_all%(str: string, re: pattern%): string_array
@ -568,7 +568,7 @@ function split_complete%(str: string,
## ##
## re: The pattern being replaced with *repl*. ## re: The pattern being replaced with *repl*.
## ##
## repl: The string that replacs *re*. ## repl: The string that replaces *re*.
## ##
## Returns: A copy of *str* with the first occurence of *re* replaced with ## Returns: A copy of *str* with the first occurence of *re* replaced with
## *repl*. ## *repl*.
@ -579,16 +579,16 @@ function sub%(str: string, re: pattern, repl: string%): string
return do_sub(str, re, repl, 0); return do_sub(str, re, repl, 0);
%} %}
## Substitutes a given replacement string for the all occurrences of a pattern ## Substitutes a given replacement string for all occurrences of a pattern
## in a given string. ## in a given string.
## ##
## str: The string to perform the substitution in. ## str: The string to perform the substitution in.
## ##
## re: The pattern being replaced with *repl*. ## re: The pattern being replaced with *repl*.
## ##
## repl: The string that replacs *re*. ## repl: The string that replaces *re*.
## ##
## Returns: A copy of *str* with all occurences of *re* replaced with *repl*. ## Returns: A copy of *str* with all occurrences of *re* replaced with *repl*.
## ##
## .. bro:see:: sub subst_string ## .. bro:see:: sub subst_string
function gsub%(str: string, re: pattern, repl: string%): string function gsub%(str: string, re: pattern, repl: string%): string
@ -597,7 +597,7 @@ function gsub%(str: string, re: pattern, repl: string%): string
%} %}
## Lexicographically compares two string. ## Lexicographically compares two strings.
## ##
## s1: The first string. ## s1: The first string.
## ##
@ -616,7 +616,7 @@ function strcmp%(s1: string, s2: string%): int
## ##
## little: The (smaller) string to find inside *big*. ## little: The (smaller) string to find inside *big*.
## ##
## Returns: The location of *little* in *big* or 0 if *little* is not found in ## Returns: The location of *little* in *big*, or 0 if *little* is not found in
## *big*. ## *big*.
## ##
## .. bro:see:: find_all find_last ## .. bro:see:: find_all find_last
@ -685,7 +685,7 @@ function subst_string%(s: string, from: string, to: string%): string
## str: The string to convert to lowercase letters. ## str: The string to convert to lowercase letters.
## ##
## Returns: A copy of the given string with the uppercase letters (as indicated ## Returns: A copy of the given string with the uppercase letters (as indicated
## by ``isascii`` and \verb|isupper|``) folded to lowercase ## by ``isascii`` and ``isupper``) folded to lowercase
## (via ``tolower``). ## (via ``tolower``).
## ##
## .. bro:see:: to_upper is_ascii ## .. bro:see:: to_upper is_ascii
@ -714,7 +714,7 @@ function to_lower%(str: string%): string
## str: The string to convert to uppercase letters. ## str: The string to convert to uppercase letters.
## ##
## Returns: A copy of the given string with the lowercase letters (as indicated ## Returns: A copy of the given string with the lowercase letters (as indicated
## by ``isascii`` and \verb|islower|``) folded to uppercase ## by ``isascii`` and ``islower``) folded to uppercase
## (via ``toupper``). ## (via ``toupper``).
## ##
## .. bro:see:: to_lower is_ascii ## .. bro:see:: to_lower is_ascii
@ -744,7 +744,7 @@ function to_upper%(str: string%): string
## - ``NUL`` to ``\0`` ## - ``NUL`` to ``\0``
## - ``DEL`` to ``^?`` ## - ``DEL`` to ``^?``
## - values <= 26 to ``^[A-Z]`` ## - values <= 26 to ``^[A-Z]``
## - values not in *[32, 126]** to ``%XX`` ## - values not in *[32, 126]* to ``%XX``
## ##
## If the string does not yet have a trailing NUL, one is added. ## If the string does not yet have a trailing NUL, one is added.
## ##
@ -765,7 +765,7 @@ function clean%(str: string%): string
## - ``NUL`` to ``\0`` ## - ``NUL`` to ``\0``
## - ``DEL`` to ``^?`` ## - ``DEL`` to ``^?``
## - values <= 26 to ``^[A-Z]`` ## - values <= 26 to ``^[A-Z]``
## - values not in *[32, 126]** to ``%XX`` ## - values not in *[32, 126]* to ``%XX``
## ##
## str: The string to escape. ## str: The string to escape.
## ##
@ -831,14 +831,16 @@ function string_to_ascii_hex%(s: string%): string
return new StringVal(new BroString(1, (u_char*) x, s->Len() * 2)); return new StringVal(new BroString(1, (u_char*) x, s->Len() * 2));
%} %}
## Uses the Smith Waterman algorithm to find similar/overlapping substrings. ## Uses the Smith-Waterman algorithm to find similar/overlapping substrings.
## See `Wikipedia <http://en.wikipedia.org/wiki/Smith%E2%80%93Waterman_algorithm>`_. ## See `Wikipedia <http://en.wikipedia.org/wiki/Smith%E2%80%93Waterman_algorithm>`_.
## ##
## s1: The first string. ## s1: The first string.
## ##
## s2: The second string. ## s2: The second string.
## ##
## Returns: The result of the Smit Waterman algorithm calculation. ## params: Parameters for the Smith-Waterman algorithm.
##
## Returns: The result of the Smith-Waterman algorithm calculation.
function str_smith_waterman%(s1: string, s2: string, params: sw_params%) : sw_substring_vec function str_smith_waterman%(s1: string, s2: string, params: sw_params%) : sw_substring_vec
%{ %{
SWParams sw_params(params->AsRecordVal()->Lookup(0)->AsCount(), SWParams sw_params(params->AsRecordVal()->Lookup(0)->AsCount(),