mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath: Documentation fixes. Replace ip6_hdr_chain with ip6_ext_hdr in comments Correct various errors in the BIF documentation
This commit is contained in:
Robin Sommer
commit
d92da36b9b
7 changed files with 161 additions and 154 deletions
4
CHANGES
4
CHANGES
|
|
@ -1,4 +1,8 @@
|
|||
|
||||
2.0-377 | 2012-05-24 16:46:06 -0700
|
||||
|
||||
* Documentation fixes. (Jon Siwek and Daniel Thayer)
|
||||
|
||||
2.0-372 | 2012-05-17 13:59:45 -0700
|
||||
|
||||
* Fix compile errors. (Jon Siwek)
|
||||
|
|
|
|||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
2.0-372
|
||||
2.0-377
|
||||
|
|
|
|||
|
|
@ -219,7 +219,7 @@ type connection: record {
|
|||
service: set[string];
|
||||
addl: string; ##< Deprecated.
|
||||
hot: count; ##< Deprecated.
|
||||
history: string; ##< State history of TCP connections. See *history* in :bro:see:`Conn::Info`.
|
||||
history: string; ##< State history of connections. See *history* in :bro:see:`Conn::Info`.
|
||||
## A globally unique connection identifier. For each connection, Bro creates an ID
|
||||
## that is very likely unique across independent Bro runs. These IDs can thus be
|
||||
## used to tag and locate information associated with that connection.
|
||||
|
|
@ -967,7 +967,7 @@ const IPPROTO_MOBILITY = 135; ##< IPv6 mobility header.
|
|||
## Values extracted from an IPv6 extension header's (e.g. hop-by-hop or
|
||||
## destination option headers) option field.
|
||||
##
|
||||
## .. bro:see:: ip6_hdr ip6_hdr_chain ip6_hopopts ip6_dstopts
|
||||
## .. bro:see:: ip6_hdr ip6_ext_hdr ip6_hopopts ip6_dstopts
|
||||
type ip6_option: record {
|
||||
otype: count; ##< Option type.
|
||||
len: count; ##< Option data length.
|
||||
|
|
@ -976,7 +976,7 @@ type ip6_option: record {
|
|||
|
||||
## Values extracted from an IPv6 Hop-by-Hop options extension header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ip6_option
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr ip6_option
|
||||
type ip6_hopopts: record {
|
||||
## Protocol number of the next header (RFC 1700 et seq., IANA assigned
|
||||
## number), e.g. :bro:id:`IPPROTO_ICMP`.
|
||||
|
|
@ -989,7 +989,7 @@ type ip6_hopopts: record {
|
|||
|
||||
## Values extracted from an IPv6 Destination options extension header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain ip6_option
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr ip6_option
|
||||
type ip6_dstopts: record {
|
||||
## Protocol number of the next header (RFC 1700 et seq., IANA assigned
|
||||
## number), e.g. :bro:id:`IPPROTO_ICMP`.
|
||||
|
|
@ -1002,7 +1002,7 @@ type ip6_dstopts: record {
|
|||
|
||||
## Values extracted from an IPv6 Routing extension header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
|
||||
type ip6_routing: record {
|
||||
## Protocol number of the next header (RFC 1700 et seq., IANA assigned
|
||||
## number), e.g. :bro:id:`IPPROTO_ICMP`.
|
||||
|
|
@ -1019,7 +1019,7 @@ type ip6_routing: record {
|
|||
|
||||
## Values extracted from an IPv6 Fragment extension header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
|
||||
type ip6_fragment: record {
|
||||
## Protocol number of the next header (RFC 1700 et seq., IANA assigned
|
||||
## number), e.g. :bro:id:`IPPROTO_ICMP`.
|
||||
|
|
@ -1038,7 +1038,7 @@ type ip6_fragment: record {
|
|||
|
||||
## Values extracted from an IPv6 Authentication extension header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
|
||||
type ip6_ah: record {
|
||||
## Protocol number of the next header (RFC 1700 et seq., IANA assigned
|
||||
## number), e.g. :bro:id:`IPPROTO_ICMP`.
|
||||
|
|
@ -1057,7 +1057,7 @@ type ip6_ah: record {
|
|||
|
||||
## Values extracted from an IPv6 ESP extension header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
|
||||
type ip6_esp: record {
|
||||
## Security Parameters Index.
|
||||
spi: count;
|
||||
|
|
@ -1067,7 +1067,7 @@ type ip6_esp: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Binding Refresh Request message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_brr: record {
|
||||
## Reserved.
|
||||
rsv: count;
|
||||
|
|
@ -1077,7 +1077,7 @@ type ip6_mobility_brr: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Home Test Init message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_hoti: record {
|
||||
## Reserved.
|
||||
rsv: count;
|
||||
|
|
@ -1089,7 +1089,7 @@ type ip6_mobility_hoti: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Care-of Test Init message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_coti: record {
|
||||
## Reserved.
|
||||
rsv: count;
|
||||
|
|
@ -1101,7 +1101,7 @@ type ip6_mobility_coti: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Home Test message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_hot: record {
|
||||
## Home Nonce Index.
|
||||
nonce_idx: count;
|
||||
|
|
@ -1115,7 +1115,7 @@ type ip6_mobility_hot: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Care-of Test message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_cot: record {
|
||||
## Care-of Nonce Index.
|
||||
nonce_idx: count;
|
||||
|
|
@ -1129,7 +1129,7 @@ type ip6_mobility_cot: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Binding Update message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_bu: record {
|
||||
## Sequence number.
|
||||
seq: count;
|
||||
|
|
@ -1149,7 +1149,7 @@ type ip6_mobility_bu: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Binding Acknowledgement message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_back: record {
|
||||
## Status.
|
||||
status: count;
|
||||
|
|
@ -1165,7 +1165,7 @@ type ip6_mobility_back: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility Binding Error message.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain ip6_mobility_msg
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg
|
||||
type ip6_mobility_be: record {
|
||||
## Status.
|
||||
status: count;
|
||||
|
|
@ -1177,7 +1177,7 @@ type ip6_mobility_be: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility header's message data.
|
||||
##
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_hdr_chain
|
||||
## .. bro:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr
|
||||
type ip6_mobility_msg: record {
|
||||
## The type of message from the header's MH Type field.
|
||||
id: count;
|
||||
|
|
@ -1201,7 +1201,7 @@ type ip6_mobility_msg: record {
|
|||
|
||||
## Values extracted from an IPv6 Mobility header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_hdr_chain
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr
|
||||
type ip6_mobility_hdr: record {
|
||||
## Protocol number of the next header (RFC 1700 et seq., IANA assigned
|
||||
## number), e.g. :bro:id:`IPPROTO_ICMP`.
|
||||
|
|
@ -1244,7 +1244,7 @@ type ip6_ext_hdr: record {
|
|||
|
||||
## Values extracted from an IPv6 header.
|
||||
##
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_hdr_chain ip6_hopopts ip6_dstopts
|
||||
## .. bro:see:: pkt_hdr ip4_hdr ip6_ext_hdr ip6_hopopts ip6_dstopts
|
||||
## ip6_routing ip6_fragment ip6_ah ip6_esp
|
||||
type ip6_hdr: record {
|
||||
class: count; ##< Traffic class.
|
||||
|
|
|
|||
|
|
@ -68,7 +68,7 @@ export {
|
|||
missed_bytes: count &log &default=0;
|
||||
|
||||
## Records the state history of connections as a string of letters.
|
||||
## For TCP connections the meaning of those letters is:
|
||||
## The meaning of those letters is:
|
||||
##
|
||||
## ====== ====================================================
|
||||
## Letter Meaning
|
||||
|
|
|
|||
200
src/bro.bif
200
src/bro.bif
|
|
@ -963,7 +963,7 @@ function sha256_hash_finish%(index: any%): string
|
|||
|
||||
## Generates a random number.
|
||||
##
|
||||
## max: The maximum value the random number.
|
||||
## max: The maximum value of the random number.
|
||||
##
|
||||
## Returns: a random positive integer in the interval *[0, max)*.
|
||||
##
|
||||
|
|
@ -1020,7 +1020,7 @@ extern "C" {
|
|||
## data: The data to find the MIME type for.
|
||||
##
|
||||
## return_mime: If true, the function returns a short MIME type string (e.g.,
|
||||
## ``text/plain`` instead of a more elaborate textual description.
|
||||
## ``text/plain`` instead of a more elaborate textual description).
|
||||
##
|
||||
## Returns: The MIME type of *data*.
|
||||
function identify_data%(data: string, return_mime: bool%): string
|
||||
|
|
@ -1241,8 +1241,6 @@ function unique_id_from%(pool: int, prefix: string%) : string
|
|||
## Removes all elements from a set or table.
|
||||
##
|
||||
## v: The set or table
|
||||
##
|
||||
## Returns: The cleared set/table or 0 if *v* is not a set/table type.
|
||||
function clear_table%(v: any%): any
|
||||
%{
|
||||
if ( v->Type()->Tag() == TYPE_TABLE )
|
||||
|
|
@ -1290,7 +1288,7 @@ function same_object%(o1: any, o2: any%): bool
|
|||
return new Val(o1 == o2, TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Returns the number bytes that a value occupies in memory.
|
||||
## Returns the number of bytes that a value occupies in memory.
|
||||
##
|
||||
## v: The value
|
||||
##
|
||||
|
|
@ -1306,7 +1304,7 @@ function val_size%(v: any%): count
|
|||
##
|
||||
## newsize: The new size of *aggr*.
|
||||
##
|
||||
## Returns: The old size of *aggr* and 0 if *aggr* is not a :bro:type:`vector`.
|
||||
## Returns: The old size of *aggr*, or 0 if *aggr* is not a :bro:type:`vector`.
|
||||
function resize%(aggr: any, newsize: count%) : count
|
||||
%{
|
||||
if ( aggr->Type()->Tag() != TYPE_VECTOR )
|
||||
|
|
@ -1423,7 +1421,7 @@ bool indirect_int_sort_function(int a, int b)
|
|||
%%}
|
||||
|
||||
## Sorts a vector in place. The second argument is a comparison function that
|
||||
## takes two arguments: if the vector type is \verb|vector of T|, then the
|
||||
## takes two arguments: if the vector type is ``vector of T``, then the
|
||||
## comparison function must be ``function(a: T, b: T): bool``, which returns
|
||||
## ``a < b`` for some type-specific notion of the less-than operator.
|
||||
##
|
||||
|
|
@ -1599,7 +1597,7 @@ function cat%(...%): string
|
|||
## given argument. If any of the variable arguments is an empty string it is
|
||||
## replaced by a given default string instead.
|
||||
##
|
||||
## sep: The separator to place betwen each argument.
|
||||
## sep: The separator to place between each argument.
|
||||
##
|
||||
## def: The default string to use when an argument is the empty string.
|
||||
##
|
||||
|
|
@ -1657,7 +1655,7 @@ function cat_sep%(sep: string, def: string, ...%): string
|
|||
##
|
||||
## - ``[DT]``: ISO timestamp with microsecond precision
|
||||
##
|
||||
## - ``d``: Signed/Unsigned integer (using C-style ``%lld|``/``%llu``
|
||||
## - ``d``: Signed/Unsigned integer (using C-style ``%lld``/``%llu``
|
||||
## for ``int``/``count``)
|
||||
##
|
||||
## - ``x``: Unsigned hexadecimal (using C-style ``%llx``);
|
||||
|
|
@ -1782,7 +1780,7 @@ function log10%(d: double%): double
|
|||
# ===========================================================================
|
||||
|
||||
## Determines whether *c* has been received externally. For example,
|
||||
## Broccoli or the Time Machine can send packets to Bro via a mechanism that
|
||||
## Broccoli or the Time Machine can send packets to Bro via a mechanism that is
|
||||
## one step lower than sending events. This function checks whether the packets
|
||||
## of a connection stem from one of these external *packet sources*.
|
||||
##
|
||||
|
|
@ -1796,7 +1794,7 @@ function is_external_connection%(c: connection%) : bool
|
|||
|
||||
## Returns the ID of the analyzer which raised the current event.
|
||||
##
|
||||
## Returns: The ID of the analyzer which raised hte current event, or 0 if
|
||||
## Returns: The ID of the analyzer which raised the current event, or 0 if
|
||||
## none.
|
||||
function current_analyzer%(%) : count
|
||||
%{
|
||||
|
|
@ -2053,7 +2051,7 @@ function get_gap_summary%(%): gap_info
|
|||
%}
|
||||
|
||||
## Generates a table of the size of all global variables. The table index is
|
||||
## the variable name and the value the variable size in bytes.
|
||||
## the variable name and the value is the variable size in bytes.
|
||||
##
|
||||
## Returns: A table that maps variable names to their sizes.
|
||||
##
|
||||
|
|
@ -2138,7 +2136,7 @@ function lookup_ID%(id: string%) : any
|
|||
return i->ID_Val()->Ref();
|
||||
%}
|
||||
|
||||
## Generates meta data about a record fields. The returned information
|
||||
## Generates metadata about a record's fields. The returned information
|
||||
## includes the field name, whether it is logged, its value (if it has one),
|
||||
## and its default value (if specified).
|
||||
##
|
||||
|
|
@ -2269,11 +2267,11 @@ function dump_rule_stats%(f: file%): bool
|
|||
return new Val(1, TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Checks wheter Bro is terminating.
|
||||
## Checks if Bro is terminating.
|
||||
##
|
||||
## Returns: True if Bro is in the process of shutting down.
|
||||
##
|
||||
## .. bro:see: terminate
|
||||
## .. bro:see:: terminate
|
||||
function bro_is_terminating%(%): bool
|
||||
%{
|
||||
return new Val(terminating, TYPE_BOOL);
|
||||
|
|
@ -2354,7 +2352,7 @@ function routing0_data_to_addrs%(s: string%): addr_vec
|
|||
return rval;
|
||||
%}
|
||||
|
||||
## Converts a :bro:type:`addr` to a :bro:type:`index_vec`.
|
||||
## Converts an :bro:type:`addr` to an :bro:type:`index_vec`.
|
||||
##
|
||||
## a: The address to convert into a vector of counts.
|
||||
##
|
||||
|
|
@ -2374,7 +2372,7 @@ function addr_to_counts%(a: addr%): index_vec
|
|||
return rval;
|
||||
%}
|
||||
|
||||
## Converts a :bro:type:`index_vec` to a :bro:type:`addr`.
|
||||
## Converts an :bro:type:`index_vec` to an :bro:type:`addr`.
|
||||
##
|
||||
## v: The vector containing host-order IP address representation,
|
||||
## one element for IPv4 addresses, four elements for IPv6 addresses.
|
||||
|
|
@ -2404,7 +2402,7 @@ function counts_to_addr%(v: index_vec%): addr
|
|||
}
|
||||
%}
|
||||
|
||||
## Converts a :bro:type:`string` to a :bro:type:`int`.
|
||||
## Converts a :bro:type:`string` to an :bro:type:`int`.
|
||||
##
|
||||
## str: The :bro:type:`string` to convert.
|
||||
##
|
||||
|
|
@ -2434,7 +2432,7 @@ function to_int%(str: string%): int
|
|||
##
|
||||
## n: The :bro:type:`int` to convert.
|
||||
##
|
||||
## Returns: The :bro:type:`int` *n* as unsigned integer or 0 if *n* < 0.
|
||||
## Returns: The :bro:type:`int` *n* as unsigned integer, or 0 if *n* < 0.
|
||||
function int_to_count%(n: int%): count
|
||||
%{
|
||||
if ( n < 0 )
|
||||
|
|
@ -2449,7 +2447,7 @@ function int_to_count%(n: int%): count
|
|||
##
|
||||
## d: The :bro:type:`double` to convert.
|
||||
##
|
||||
## Returns: The :bro:type:`double` *d* as unsigned integer or 0 if *d* < 0.0.
|
||||
## Returns: The :bro:type:`double` *d* as unsigned integer, or 0 if *d* < 0.0.
|
||||
##
|
||||
## .. bro:see:: double_to_time
|
||||
function double_to_count%(d: double%): count
|
||||
|
|
@ -2464,8 +2462,8 @@ function double_to_count%(d: double%): count
|
|||
##
|
||||
## str: The :bro:type:`string` to convert.
|
||||
##
|
||||
## Returns: The :bro:type:`string` *str* as unsigned integer or if in invalid
|
||||
## format.
|
||||
## Returns: The :bro:type:`string` *str* as unsigned integer, or 0 if *str* has
|
||||
## an invalid format.
|
||||
##
|
||||
## .. bro:see:: to_addr to_int to_port to_subnet
|
||||
function to_count%(str: string%): count
|
||||
|
|
@ -2498,7 +2496,7 @@ function interval_to_double%(i: interval%): double
|
|||
|
||||
## Converts a :bro:type:`time` value to a :bro:type:`double`.
|
||||
##
|
||||
## t: The :bro:type:`interval` to convert.
|
||||
## t: The :bro:type:`time` to convert.
|
||||
##
|
||||
## Returns: The :bro:type:`time` value *t* as :bro:type:`double`.
|
||||
##
|
||||
|
|
@ -2508,11 +2506,11 @@ function time_to_double%(t: time%): double
|
|||
return new Val(t, TYPE_DOUBLE);
|
||||
%}
|
||||
|
||||
## Converts a :bro:type:`time` value to a :bro:type:`double`.
|
||||
## Converts a :bro:type:`double` value to a :bro:type:`time`.
|
||||
##
|
||||
## t: The :bro:type:`interval` to convert.
|
||||
## d: The :bro:type:`double` to convert.
|
||||
##
|
||||
## Returns: The :bro:type:`time` value *t* as :bro:type:`double`.
|
||||
## Returns: The :bro:type:`double` value *d* as :bro:type:`time`.
|
||||
##
|
||||
## .. bro:see:: time_to_double double_to_count
|
||||
function double_to_time%(d: double%): time
|
||||
|
|
@ -2550,7 +2548,7 @@ function port_to_count%(p: port%): count
|
|||
##
|
||||
## proto: The transport protocol.
|
||||
##
|
||||
## Returns: The :bro:type:`count` *c* as :bro:type:`port`.
|
||||
## Returns: The :bro:type:`count` *num* as :bro:type:`port`.
|
||||
##
|
||||
## .. bro:see:: port_to_count
|
||||
function count_to_port%(num: count, proto: transport_proto%): port
|
||||
|
|
@ -2562,7 +2560,7 @@ function count_to_port%(num: count, proto: transport_proto%): port
|
|||
##
|
||||
## ip: The :bro:type:`string` to convert.
|
||||
##
|
||||
## Returns: The :bro:type:`string` *ip* as :bro:type:`addr` or the unspecified
|
||||
## Returns: The :bro:type:`string` *ip* as :bro:type:`addr`, or the unspecified
|
||||
## address ``::`` if the input string does not parse correctly.
|
||||
##
|
||||
## .. bro:see:: to_count to_int to_port count_to_v4_addr raw_bytes_to_v4_addr
|
||||
|
|
@ -2579,7 +2577,7 @@ function to_addr%(ip: string%): addr
|
|||
##
|
||||
## sn: The subnet to convert.
|
||||
##
|
||||
## Returns: The *sn* string as a :bro:type:`subnet` or the unspecified subnet
|
||||
## Returns: The *sn* string as a :bro:type:`subnet`, or the unspecified subnet
|
||||
## ``::/0`` if the input string does not parse correctly.
|
||||
##
|
||||
## .. bro:see:: to_count to_int to_port count_to_v4_addr raw_bytes_to_v4_addr
|
||||
|
|
@ -2616,7 +2614,7 @@ function count_to_v4_addr%(ip: count%): addr
|
|||
##
|
||||
## b: The raw bytes (:bro:type:`string`) to convert.
|
||||
##
|
||||
## Returns: The byte :bro:type:`string` *ip* as :bro:type:`addr`.
|
||||
## Returns: The byte :bro:type:`string` *b* as :bro:type:`addr`.
|
||||
##
|
||||
## .. bro:see:: raw_bytes_to_v4_addr to_addr to_subnet
|
||||
function raw_bytes_to_v4_addr%(b: string%): addr
|
||||
|
|
@ -2635,7 +2633,7 @@ function raw_bytes_to_v4_addr%(b: string%): addr
|
|||
return new AddrVal(htonl(a));
|
||||
%}
|
||||
|
||||
## Converts a :bro:type:`string` to an :bro:type:`port`.
|
||||
## Converts a :bro:type:`string` to a :bro:type:`port`.
|
||||
##
|
||||
## s: The :bro:type:`string` to convert.
|
||||
##
|
||||
|
|
@ -2885,7 +2883,7 @@ function parse_ftp_port%(s: string%): ftp_port
|
|||
%}
|
||||
|
||||
## Converts a string representation of the FTP EPRT command to an ``ftp_port``.
|
||||
## (see `RFC 2428 <http://tools.ietf.org/html/rfc2428>`_).
|
||||
## See `RFC 2428 <http://tools.ietf.org/html/rfc2428>`_.
|
||||
## The format is ``EPRT<space><d><net-prt><d><net-addr><d><tcp-port><d>``,
|
||||
## where ``<d>`` is a delimiter in the ASCII range 33-126 (usually ``|``).
|
||||
##
|
||||
|
|
@ -2976,7 +2974,7 @@ function fmt_ftp_port%(a: addr, p: port%): string
|
|||
|
||||
## Decode a NetBIOS name. See http://support.microsoft.com/kb/194203.
|
||||
##
|
||||
## name: The encoded NetBIOS name, e.g., ``"FEEIEFCAEOEFFEECEJEPFDCAEOEBENEF:``.
|
||||
## name: The encoded NetBIOS name, e.g., ``"FEEIEFCAEOEFFEECEJEPFDCAEOEBENEF"``.
|
||||
##
|
||||
## Returns: The decoded NetBIOS name, e.g., ``"THE NETBIOS NAME"``.
|
||||
##
|
||||
|
|
@ -3009,7 +3007,7 @@ function decode_netbios_name%(name: string%): string
|
|||
return new StringVal(i, result);
|
||||
%}
|
||||
|
||||
## Converts a NetBIOS name type to its corresonding numeric value.
|
||||
## Converts a NetBIOS name type to its corresponding numeric value.
|
||||
## See http://support.microsoft.com/kb/163409.
|
||||
##
|
||||
## name: The NetBIOS name type.
|
||||
|
|
@ -3029,7 +3027,7 @@ function decode_netbios_name_type%(name: string%): count
|
|||
##
|
||||
## bytestring: The string of bytes.
|
||||
##
|
||||
## Returns: The hexadecimal reprsentation of *bytestring*.
|
||||
## Returns: The hexadecimal representation of *bytestring*.
|
||||
##
|
||||
## .. bro:see:: hexdump
|
||||
function bytestring_to_hexstr%(bytestring: string%): string
|
||||
|
|
@ -3069,7 +3067,7 @@ function decode_base64%(s: string%): string
|
|||
## s: The Base64-encoded string.
|
||||
##
|
||||
## a: The custom alphabet. The empty string indicates the default alphabet. The
|
||||
## lengh of *a* must bt 64. For example, a custom alphabet could be
|
||||
## length of *a* must be 64. For example, a custom alphabet could be
|
||||
## ``"!#$%&/(),-.:;<>@[]^ `_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?"``.
|
||||
##
|
||||
## Returns: The decoded version of *s*.
|
||||
|
|
@ -3138,7 +3136,7 @@ function uuid_to_string%(uuid: string%): string
|
|||
##
|
||||
## p2: The second pattern.
|
||||
##
|
||||
## Returns: The compiled pattern of the concatentation of *p1* and *p2*.
|
||||
## Returns: The compiled pattern of the concatenation of *p1* and *p2*.
|
||||
##
|
||||
## .. bro:see:: convert_for_pattern string_to_pattern
|
||||
##
|
||||
|
|
@ -3277,7 +3275,7 @@ function strftime%(fmt: string, d: time%) : string
|
|||
## a: The address to mask.
|
||||
##
|
||||
## top_bits_to_keep: The number of top bits to keep in *a*; must be greater
|
||||
## than 0 and less than 33.
|
||||
## than 0 and less than 33 for IPv4, or 129 for IPv6.
|
||||
##
|
||||
## Returns: The address *a* masked down to *top_bits_to_keep* bits.
|
||||
##
|
||||
|
|
@ -3341,7 +3339,7 @@ function is_udp_port%(p: port%): bool
|
|||
##
|
||||
## p: The :bro:type:`port` to check.
|
||||
##
|
||||
## Returns: True iff *p* is a ICMP port.
|
||||
## Returns: True iff *p* is an ICMP port.
|
||||
##
|
||||
## .. bro:see:: is_tcp_port is_udp_port
|
||||
function is_icmp_port%(p: port%): bool
|
||||
|
|
@ -3383,7 +3381,7 @@ EnumVal* map_conn_type(TransportProto tp)
|
|||
##
|
||||
## cid: The connection identifier.
|
||||
##
|
||||
## Returns: The transport protocol of the connection identified by *id*.
|
||||
## Returns: The transport protocol of the connection identified by *cid*.
|
||||
##
|
||||
## .. bro:see:: get_port_transport_proto
|
||||
## get_orig_seq get_resp_seq
|
||||
|
|
@ -3497,7 +3495,7 @@ const char* conn_id_string(Val* c)
|
|||
##
|
||||
## c: The HTTP connection.
|
||||
##
|
||||
## is_orig: If true, the client data is skipped and the server data otherwise.
|
||||
## is_orig: If true, the client data is skipped, and the server data otherwise.
|
||||
##
|
||||
## .. bro:see:: skip_smtp_data
|
||||
function skip_http_entity_data%(c: connection, is_orig: bool%): any
|
||||
|
|
@ -3572,7 +3570,7 @@ function dump_current_packet%(file_name: string%) : bool
|
|||
|
||||
## Returns the currently processed PCAP packet.
|
||||
##
|
||||
## Returns: The currently processed packet, which is as a record
|
||||
## Returns: The currently processed packet, which is a record
|
||||
## containing the timestamp, ``snaplen``, and packet data.
|
||||
##
|
||||
## .. bro:see:: dump_current_packet dump_packet send_current_packet
|
||||
|
|
@ -3730,7 +3728,7 @@ function lookup_addr%(host: addr%) : string
|
|||
##
|
||||
## host: The hostname to lookup.
|
||||
##
|
||||
## Returns: A set of DNS A records associated with *host*.
|
||||
## Returns: A set of DNS A and AAAA records associated with *host*.
|
||||
##
|
||||
## .. bro:see:: lookup_addr
|
||||
function lookup_hostname%(host: string%) : addr_set
|
||||
|
|
@ -3897,6 +3895,7 @@ function lookup_location%(a: addr%) : geo_location
|
|||
%}
|
||||
|
||||
## Performs an AS lookup of an IP address.
|
||||
## Requires Bro to be built with ``libgeoip``.
|
||||
##
|
||||
## a: The IP address to lookup.
|
||||
##
|
||||
|
|
@ -4096,7 +4095,7 @@ function x509_err2str%(err_num: count%): string
|
|||
|
||||
## Converts UNIX file permissions given by a mode to an ASCII string.
|
||||
##
|
||||
## mode: The permisssions, e.g., 644 or 755.
|
||||
## mode: The permissions (an octal number like 0644 converted to decimal).
|
||||
##
|
||||
## Returns: A string representation of *mode* in the format
|
||||
## ``rw[xsS]rw[xsS]rw[xtT]``.
|
||||
|
|
@ -4273,7 +4272,7 @@ function analyzer_name%(aid: count%) : string
|
|||
##
|
||||
## cid: The connection ID.
|
||||
##
|
||||
## Returns: False if *id* does not point to an active connection and true
|
||||
## Returns: False if *cid* does not point to an active connection, and true
|
||||
## otherwise.
|
||||
##
|
||||
## .. note::
|
||||
|
|
@ -4295,10 +4294,10 @@ function skip_further_processing%(cid: conn_id%): bool
|
|||
##
|
||||
## cid: The connection identifier.
|
||||
##
|
||||
## do_record: True to enable packet contens and false to disable for the
|
||||
## do_record: True to enable packet contents, and false to disable for the
|
||||
## connection identified by *cid*.
|
||||
##
|
||||
## Returns: False if *id* does not point to an active connection and true
|
||||
## Returns: False if *cid* does not point to an active connection, and true
|
||||
## otherwise.
|
||||
##
|
||||
## .. bro:see:: skip_further_processing
|
||||
|
|
@ -4309,7 +4308,7 @@ function skip_further_processing%(cid: conn_id%): bool
|
|||
## connection, which is controlled separately by
|
||||
## :bro:id:`skip_further_processing`.
|
||||
##
|
||||
## .. bro:see: get_contents_file set_contents_file
|
||||
## .. bro:see:: get_contents_file set_contents_file
|
||||
function set_record_packets%(cid: conn_id, do_record: bool%): bool
|
||||
%{
|
||||
Connection* c = sessions->FindConnection(cid);
|
||||
|
|
@ -4326,7 +4325,7 @@ function set_record_packets%(cid: conn_id, do_record: bool%): bool
|
|||
## cid: The connection ID.
|
||||
##
|
||||
## direction: Controls what sides of the connection to record. The argument can
|
||||
## take one the four values:
|
||||
## take one of the four values:
|
||||
##
|
||||
## - ``CONTENTS_NONE``: Stop recording the connection's content.
|
||||
## - ``CONTENTS_ORIG``: Record the data sent by the connection
|
||||
|
|
@ -4340,7 +4339,7 @@ function set_record_packets%(cid: conn_id, do_record: bool%): bool
|
|||
##
|
||||
## f: The file handle of the file to write the contents to.
|
||||
##
|
||||
## Returns: Returns false if *id* does not point to an active connection and
|
||||
## Returns: Returns false if *cid* does not point to an active connection, and
|
||||
## true otherwise.
|
||||
##
|
||||
## .. note::
|
||||
|
|
@ -4351,7 +4350,7 @@ function set_record_packets%(cid: conn_id, do_record: bool%): bool
|
|||
## missing data; this can happen, e.g., due to an
|
||||
## :bro:id:`ack_above_hole` event.
|
||||
##
|
||||
## .. bro:see: get_contents_file set_record_packets
|
||||
## .. bro:see:: get_contents_file set_record_packets
|
||||
function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
|
||||
%{
|
||||
Connection* c = sessions->FindConnection(cid);
|
||||
|
|
@ -4366,15 +4365,15 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
|
|||
##
|
||||
## cid: The connection ID.
|
||||
##
|
||||
## direction: Controls what sides of the connection to record. SEe
|
||||
## direction: Controls what sides of the connection to record. See
|
||||
## :bro:id:`set_contents_file` for possible values.
|
||||
##
|
||||
## Returns: The :bro:type:`file` handle for the contentents file of the
|
||||
## Returns: The :bro:type:`file` handle for the contents file of the
|
||||
## connection identified by *cid*. If the connection exists
|
||||
## but no contents file for *direction*, the function generates a
|
||||
## error and returns a file handle to ``stderr``.
|
||||
## but there is no contents file for *direction*, then the function
|
||||
## generates an error and returns a file handle to ``stderr``.
|
||||
##
|
||||
## .. bro:see: set_contents_file set_record_packets
|
||||
## .. bro:see:: set_contents_file set_record_packets
|
||||
function get_contents_file%(cid: conn_id, direction: count%): file
|
||||
%{
|
||||
Connection* c = sessions->FindConnection(cid);
|
||||
|
|
@ -4425,7 +4424,7 @@ function set_inactivity_timeout%(cid: conn_id, t: interval%): interval
|
|||
##
|
||||
## - ``LOGIN_STATE_AUTHENTICATE``: The connection is in its
|
||||
## initial authentication dialog.
|
||||
## - ``OGIN_STATE_LOGGED_IN``: The analyzer believes the user has
|
||||
## - ``LOGIN_STATE_LOGGED_IN``: The analyzer believes the user has
|
||||
## successfully authenticated.
|
||||
## - ``LOGIN_STATE_SKIP``: The analyzer has skipped any further
|
||||
## processing of the connection.
|
||||
|
|
@ -4433,7 +4432,7 @@ function set_inactivity_timeout%(cid: conn_id, t: interval%): interval
|
|||
## does not correctly know the state of the connection, and/or
|
||||
## the username associated with it.
|
||||
##
|
||||
## .. bro:see: set_login_state
|
||||
## .. bro:see:: set_login_state
|
||||
function get_login_state%(cid: conn_id%): count
|
||||
%{
|
||||
Connection* c = sessions->FindConnection(cid);
|
||||
|
|
@ -4456,9 +4455,9 @@ function get_login_state%(cid: conn_id%): count
|
|||
## :bro:id:`get_login_state` for possible values.
|
||||
##
|
||||
## Returns: Returns false if *cid* is not an active connection
|
||||
## or does not tagged as login analyzer, and true otherwise.
|
||||
## or is not tagged as a login analyzer, and true otherwise.
|
||||
##
|
||||
## .. bro:see: get_login_state
|
||||
## .. bro:see:: get_login_state
|
||||
function set_login_state%(cid: conn_id, new_state: count%): bool
|
||||
%{
|
||||
Connection* c = sessions->FindConnection(cid);
|
||||
|
|
@ -4592,7 +4591,7 @@ function disable_event_group%(group: string%) : any
|
|||
##
|
||||
## Returns: A :bro:type:`file` handle for subsequent operations.
|
||||
##
|
||||
## .. bro:see;: active_file open_for_append close write_file
|
||||
## .. bro:see:: active_file open_for_append close write_file
|
||||
## get_file_name set_buf flush_all mkdir enable_raw_output
|
||||
function open%(f: string%): file
|
||||
%{
|
||||
|
|
@ -4611,7 +4610,7 @@ function open%(f: string%): file
|
|||
##
|
||||
## Returns: A :bro:type:`file` handle for subsequent operations.
|
||||
##
|
||||
## .. bro:see;: active_file open close write_file
|
||||
## .. bro:see:: active_file open close write_file
|
||||
## get_file_name set_buf flush_all mkdir enable_raw_output
|
||||
function open_for_append%(f: string%): file
|
||||
%{
|
||||
|
|
@ -4619,13 +4618,12 @@ function open_for_append%(f: string%): file
|
|||
%}
|
||||
|
||||
## Closes an open file and flushes any buffered content.
|
||||
## exists, this function appends to it (as opposed to :bro:id:`open`).
|
||||
##
|
||||
## f: A :bro:type:`file` handle to an open file.
|
||||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
## .. bro:see;: active_file open open_for_append write_file
|
||||
## .. bro:see:: active_file open open_for_append write_file
|
||||
## get_file_name set_buf flush_all mkdir enable_raw_output
|
||||
function close%(f: file%): bool
|
||||
%{
|
||||
|
|
@ -4640,7 +4638,7 @@ function close%(f: file%): bool
|
|||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
## .. bro:see;: active_file open open_for_append close
|
||||
## .. bro:see:: active_file open open_for_append close
|
||||
## get_file_name set_buf flush_all mkdir enable_raw_output
|
||||
function write_file%(f: file, data: string%): bool
|
||||
%{
|
||||
|
|
@ -4656,11 +4654,11 @@ function write_file%(f: file, data: string%): bool
|
|||
## f: A :bro:type:`file` handle to an open file.
|
||||
##
|
||||
## buffered: When true, *f* is fully buffered, i.e., bytes are saved in a
|
||||
## buffered until the block size has been reached. When
|
||||
## buffer until the block size has been reached. When
|
||||
## false, *f* is line buffered, i.e., bytes are saved up until a
|
||||
## newline occurs.
|
||||
##
|
||||
## .. bro:see;: active_file open open_for_append close
|
||||
## .. bro:see:: active_file open open_for_append close
|
||||
## get_file_name write_file flush_all mkdir enable_raw_output
|
||||
function set_buf%(f: file, buffered: bool%): any
|
||||
%{
|
||||
|
|
@ -4672,7 +4670,7 @@ function set_buf%(f: file, buffered: bool%): any
|
|||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
## .. bro:see;: active_file open open_for_append close
|
||||
## .. bro:see:: active_file open open_for_append close
|
||||
## get_file_name write_file set_buf mkdir enable_raw_output
|
||||
function flush_all%(%): bool
|
||||
%{
|
||||
|
|
@ -4683,10 +4681,10 @@ function flush_all%(%): bool
|
|||
##
|
||||
## f: The directory name.
|
||||
##
|
||||
## Returns: Returns true if the operation succeeds and false if the
|
||||
## Returns: Returns true if the operation succeeds, or false if the
|
||||
## creation fails or if *f* exists already.
|
||||
##
|
||||
## .. bro:see;: active_file open_for_append close write_file
|
||||
## .. bro:see:: active_file open_for_append close write_file
|
||||
## get_file_name set_buf flush_all enable_raw_output
|
||||
function mkdir%(f: string%): bool
|
||||
%{
|
||||
|
|
@ -4731,7 +4729,7 @@ function get_file_name%(f: file%): string
|
|||
##
|
||||
## f: An open file handle.
|
||||
##
|
||||
## Returns: Rotations statistics which include the original file name, the name
|
||||
## Returns: Rotation statistics which include the original file name, the name
|
||||
## after the rotation, and the time when *f* was opened/closed.
|
||||
##
|
||||
## .. bro:see:: rotate_file_by_name calc_next_rotate
|
||||
|
|
@ -4755,7 +4753,7 @@ function rotate_file%(f: file%): rotate_info
|
|||
##
|
||||
## f: The name of the file to rotate
|
||||
##
|
||||
## Returns: Rotations statistics which include the original file name, the name
|
||||
## Returns: Rotation statistics which include the original file name, the name
|
||||
## after the rotation, and the time when *f* was opened/closed.
|
||||
##
|
||||
## .. bro:see:: rotate_file calc_next_rotate
|
||||
|
|
@ -4851,7 +4849,7 @@ function disable_print_hook%(f: file%): any
|
|||
return 0;
|
||||
%}
|
||||
|
||||
## Prevents escaping of non-ASCII character when writing to a file.
|
||||
## Prevents escaping of non-ASCII characters when writing to a file.
|
||||
## This function is equivalent to :bro:attr:`&disable_print_hook`.
|
||||
##
|
||||
## f: The file to disable raw output for.
|
||||
|
|
@ -5213,9 +5211,9 @@ function checkpoint_state%(%) : bool
|
|||
return new Val(persistence_serializer->WriteState(true), TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Reads persistent state from the \texttt{.state} directory and populates the
|
||||
## in-memory data structures accordingly. This function is the dual to
|
||||
## :bro:id:`checkpoint_state`.
|
||||
## Reads persistent state and populates the in-memory data structures
|
||||
## accordingly. Persistent state is read from the ``.state`` directory.
|
||||
## This function is the dual to :bro:id:`checkpoint_state`.
|
||||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
|
|
@ -5267,16 +5265,16 @@ function capture_state_updates%(filename: string%) : bool
|
|||
##
|
||||
## ip: The IP address of the remote peer.
|
||||
##
|
||||
## port: The port of the remote peer.
|
||||
## p: The port of the remote peer.
|
||||
##
|
||||
## our_class: If an non-empty string, the remote (listening) peer checks it
|
||||
## our_class: If a non-empty string, then the remote (listening) peer checks it
|
||||
## against its class name in its peer table and terminates the
|
||||
## connection if they don't match.
|
||||
##
|
||||
## retry: If the connection fails, try to reconnect with the peer after this
|
||||
## time interval.
|
||||
##
|
||||
## ssl: If true, uses SSL to encrypt the session.
|
||||
## ssl: If true, use SSL to encrypt the session.
|
||||
##
|
||||
## Returns: A locally unique ID of the new peer.
|
||||
##
|
||||
|
|
@ -5299,7 +5297,7 @@ function connect%(ip: addr, p: port, our_class: string, retry: interval, ssl: bo
|
|||
|
||||
## Terminate the connection with a peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
|
|
@ -5313,7 +5311,7 @@ function disconnect%(p: event_peer%) : bool
|
|||
## Subscribes to all events from a remote peer whose names match a given
|
||||
## pattern.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## handlers: The pattern describing the events to request from peer *p*.
|
||||
##
|
||||
|
|
@ -5331,7 +5329,7 @@ function request_remote_events%(p: event_peer, handlers: pattern%) : bool
|
|||
|
||||
## Requests synchronization of IDs with a remote peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## auth: If true, the local instance considers its current state authoritative
|
||||
## and sends it to *p* right after the handshake.
|
||||
|
|
@ -5349,7 +5347,7 @@ function request_remote_sync%(p: event_peer, auth: bool%) : bool
|
|||
|
||||
## Requests logs from a remote peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
|
|
@ -5361,9 +5359,11 @@ function request_remote_logs%(p: event_peer%) : bool
|
|||
return new Val(remote_serializer->RequestLogs(id), TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Sets a boolean flag whether Bro accepts state from a remote peer.
|
||||
## Sets a boolean flag indicating whether Bro accepts state from a remote peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## accept: True if Bro accepts state from peer *p*, or false otherwise.
|
||||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
|
|
@ -5379,7 +5379,7 @@ function set_accept_state%(p: event_peer, accept: bool%) : bool
|
|||
|
||||
## Sets the compression level of the session with a remote peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## level: Allowed values are in the range *[0, 9]*, where 0 is the default and
|
||||
## means no compression.
|
||||
|
|
@ -5394,11 +5394,11 @@ function set_compression_level%(p: event_peer, level: count%) : bool
|
|||
TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Listens on address a given IP address and port for remote connections.
|
||||
## Listens on a given IP address and port for remote connections.
|
||||
##
|
||||
## ip: The IP address to bind to.
|
||||
##
|
||||
## p: The TCP port to listen to.
|
||||
## p: The TCP port to listen on.
|
||||
##
|
||||
## ssl: If true, Bro uses SSL to encrypt the session.
|
||||
##
|
||||
|
|
@ -5420,7 +5420,7 @@ function is_remote_event%(%) : bool
|
|||
|
||||
## Sends all persistent state to a remote peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## Returns: True on success.
|
||||
##
|
||||
|
|
@ -5431,10 +5431,10 @@ function send_state%(p: event_peer%) : bool
|
|||
return new Val(persistence_serializer->SendState(id, true), TYPE_BOOL);
|
||||
%}
|
||||
|
||||
## Sends a global identifier to a remote peer, which them might install it
|
||||
## Sends a global identifier to a remote peer, which then might install it
|
||||
## locally.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## id: The identifier to send.
|
||||
##
|
||||
|
|
@ -5468,7 +5468,7 @@ function terminate_communication%(%) : bool
|
|||
## Signals a remote peer that the local Bro instance finished the initial
|
||||
## handshake.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## Returns: True on success.
|
||||
function complete_handshake%(p: event_peer%) : bool
|
||||
|
|
@ -5481,7 +5481,7 @@ function complete_handshake%(p: event_peer%) : bool
|
|||
## for :bro:id:`remote_pong`, this function can be used to measure latency
|
||||
## between two peers.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## seq: A sequence number (also included by :bro:id:`remote_pong`).
|
||||
##
|
||||
|
|
@ -5496,7 +5496,7 @@ function send_ping%(p: event_peer, seq: count%) : bool
|
|||
|
||||
## Sends the currently processed packet to a remote peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## Returns: True if sending the packet succeeds.
|
||||
##
|
||||
|
|
@ -5522,7 +5522,7 @@ function send_current_packet%(p: event_peer%) : bool
|
|||
|
||||
## Returns the peer who generated the last event.
|
||||
##
|
||||
## Returns: The ID of the peer who genereated the last event.
|
||||
## Returns: The ID of the peer who generated the last event.
|
||||
##
|
||||
## .. bro:see:: get_local_event_peer
|
||||
function get_event_peer%(%) : event_peer
|
||||
|
|
@ -5565,7 +5565,7 @@ function get_local_event_peer%(%) : event_peer
|
|||
|
||||
## Sends a capture filter to a remote peer.
|
||||
##
|
||||
## p: The peer ID return from :bro:id:`connect`.
|
||||
## p: The peer ID returned from :bro:id:`connect`.
|
||||
##
|
||||
## s: The capture filter.
|
||||
##
|
||||
|
|
@ -5582,7 +5582,7 @@ function send_capture_filter%(p: event_peer, s: string%) : bool
|
|||
## distributed trace processing with communication enabled
|
||||
## (*pseudo-realtime* mode).
|
||||
##
|
||||
## .. bro:see: continue_processing suspend_state_updates resume_state_updates
|
||||
## .. bro:see:: continue_processing suspend_state_updates resume_state_updates
|
||||
function suspend_processing%(%) : any
|
||||
%{
|
||||
net_suspend_processing();
|
||||
|
|
@ -5591,7 +5591,7 @@ function suspend_processing%(%) : any
|
|||
|
||||
## Resumes Bro's packet processing.
|
||||
##
|
||||
## .. bro:see: suspend_processing suspend_state_updates resume_state_updates
|
||||
## .. bro:see:: suspend_processing suspend_state_updates resume_state_updates
|
||||
function continue_processing%(%) : any
|
||||
%{
|
||||
net_continue_processing();
|
||||
|
|
@ -5600,7 +5600,7 @@ function continue_processing%(%) : any
|
|||
|
||||
## Stops propagating :bro:attr:`&synchronized` accesses.
|
||||
##
|
||||
## .. bro:see: suspend_processing continue_processing resume_state_updates
|
||||
## .. bro:see:: suspend_processing continue_processing resume_state_updates
|
||||
function suspend_state_updates%(%) : any
|
||||
%{
|
||||
if ( remote_serializer )
|
||||
|
|
@ -5610,7 +5610,7 @@ function suspend_state_updates%(%) : any
|
|||
|
||||
## Resumes propagating :bro:attr:`&synchronized` accesses.
|
||||
##
|
||||
## .. bro:see: suspend_processing continue_processing suspend_state_updates
|
||||
## .. bro:see:: suspend_processing continue_processing suspend_state_updates
|
||||
function resume_state_updates%(%) : any
|
||||
%{
|
||||
if ( remote_serializer )
|
||||
|
|
|
|||
|
|
@ -171,8 +171,11 @@ event new_connection_contents%(c: connection%);
|
|||
## new_connection new_connection_contents partial_connection
|
||||
event connection_attempt%(c: connection%);
|
||||
|
||||
## Generated for an established TCP connection. The event is raised when the
|
||||
## initial 3-way TCP handshake has successfully finished for a connection.
|
||||
## Generated when a SYN-ACK packet is seen in response to SYN a packet during
|
||||
## a TCP handshake. The final ACK of the handshake in response to SYN-ACK may
|
||||
## or may not occur later, one way to tell is to check the *history* field of
|
||||
## :bro:type:`connection` to see if the originator sent an ACK, indicated by
|
||||
## 'A' in the history string.
|
||||
##
|
||||
## c: The connection.
|
||||
##
|
||||
|
|
@ -335,8 +338,6 @@ event connection_SYN_packet%(c: connection, pkt: SYN_packet%);
|
|||
##
|
||||
## c: The connection.
|
||||
##
|
||||
## pkt: Information extracted from the SYN packet.
|
||||
##
|
||||
## .. bro:see:: connection_EOF connection_SYN_packet connection_attempt
|
||||
## connection_established connection_external connection_finished
|
||||
## connection_half_finished connection_partial_close connection_pending
|
||||
|
|
|
|||
|
|
@ -11,8 +11,8 @@ using namespace std;
|
|||
%%}
|
||||
|
||||
|
||||
## Concates all arguments into a single string. The function takes a variable
|
||||
## number of arguments of type string and stiches them together.
|
||||
## Concatenates all arguments into a single string. The function takes a
|
||||
## variable number of arguments of type string and stitches them together.
|
||||
##
|
||||
## Returns: The concatenation of all (string) arguments.
|
||||
##
|
||||
|
|
@ -157,9 +157,9 @@ function join_string_array%(sep: string, a: string_array%): string
|
|||
##
|
||||
## sep: The separator to place between each element.
|
||||
##
|
||||
## a: The :bro:type:`string_vec` (``vector of string``).
|
||||
## vec: The :bro:type:`string_vec` (``vector of string``).
|
||||
##
|
||||
## Returns: The concatenation of all elements in *a*, with *sep* placed
|
||||
## Returns: The concatenation of all elements in *vec*, with *sep* placed
|
||||
## between each element.
|
||||
##
|
||||
## .. bro:see:: cat cat_sep string_cat cat_string_array cat_string_array_n
|
||||
|
|
@ -219,7 +219,7 @@ function sort_string_array%(a: string_array%): string_array
|
|||
|
||||
## Returns an edited version of a string that applies a special
|
||||
## "backspace character" (usually ``\x08`` for backspace or ``\x7f`` for DEL).
|
||||
## For ## example, ``edit("hello there", "e")`` returns ``"llo t"``.
|
||||
## For example, ``edit("hello there", "e")`` returns ``"llo t"``.
|
||||
##
|
||||
## arg_s: The string to edit.
|
||||
##
|
||||
|
|
@ -229,7 +229,7 @@ function sort_string_array%(a: string_array%): string_array
|
|||
## the string.
|
||||
##
|
||||
## Returns: An edited version of *arg_s* where *arg_edit_char* triggers the
|
||||
## deletetion of the last character.
|
||||
## deletion of the last character.
|
||||
##
|
||||
## .. bro:see:: clean
|
||||
## to_string_literal
|
||||
|
|
@ -278,7 +278,7 @@ function byte_len%(s: string%): count
|
|||
return new Val(s->Len(), TYPE_COUNT);
|
||||
%}
|
||||
|
||||
## Get a substring of from a string, given a starting position length.
|
||||
## Get a substring from a string, given a starting position and length.
|
||||
##
|
||||
## s: The string to obtain a substring from.
|
||||
##
|
||||
|
|
@ -486,10 +486,10 @@ function split%(str: string, re: pattern%): string_array
|
|||
return do_split(str, re, 0, 0, 0);
|
||||
%}
|
||||
|
||||
## Splits a string *once* into a a two-element array of strings according to a
|
||||
## pattern. This function is the same as :bro:id:`split`, but * is only split
|
||||
## once (if possible) at the earliest position and an array of two strings is
|
||||
## returned.
|
||||
## Splits a string *once* into a two-element array of strings according to a
|
||||
## pattern. This function is the same as :bro:id:`split`, but *str* is only
|
||||
## split once (if possible) at the earliest position and an array of two strings
|
||||
## is returned.
|
||||
##
|
||||
## str: The string to split.
|
||||
##
|
||||
|
|
@ -518,7 +518,7 @@ function split1%(str: string, re: pattern%): string_array
|
|||
##
|
||||
## Returns: An array of strings where each two successive elements correspond
|
||||
## to a substring in *str* of the part not matching *re* (odd-indexed)
|
||||
## and thei part that matches *re* (even-indexed).
|
||||
## and the part that matches *re* (even-indexed).
|
||||
##
|
||||
## .. bro:see:: split split1 split_n str_split
|
||||
function split_all%(str: string, re: pattern%): string_array
|
||||
|
|
@ -568,7 +568,7 @@ function split_complete%(str: string,
|
|||
##
|
||||
## re: The pattern being replaced with *repl*.
|
||||
##
|
||||
## repl: The string that replacs *re*.
|
||||
## repl: The string that replaces *re*.
|
||||
##
|
||||
## Returns: A copy of *str* with the first occurence of *re* replaced with
|
||||
## *repl*.
|
||||
|
|
@ -579,16 +579,16 @@ function sub%(str: string, re: pattern, repl: string%): string
|
|||
return do_sub(str, re, repl, 0);
|
||||
%}
|
||||
|
||||
## Substitutes a given replacement string for the all occurrences of a pattern
|
||||
## Substitutes a given replacement string for all occurrences of a pattern
|
||||
## in a given string.
|
||||
##
|
||||
## str: The string to perform the substitution in.
|
||||
##
|
||||
## re: The pattern being replaced with *repl*.
|
||||
##
|
||||
## repl: The string that replacs *re*.
|
||||
## repl: The string that replaces *re*.
|
||||
##
|
||||
## Returns: A copy of *str* with all occurences of *re* replaced with *repl*.
|
||||
## Returns: A copy of *str* with all occurrences of *re* replaced with *repl*.
|
||||
##
|
||||
## .. bro:see:: sub subst_string
|
||||
function gsub%(str: string, re: pattern, repl: string%): string
|
||||
|
|
@ -597,7 +597,7 @@ function gsub%(str: string, re: pattern, repl: string%): string
|
|||
%}
|
||||
|
||||
|
||||
## Lexicographically compares two string.
|
||||
## Lexicographically compares two strings.
|
||||
##
|
||||
## s1: The first string.
|
||||
##
|
||||
|
|
@ -616,7 +616,7 @@ function strcmp%(s1: string, s2: string%): int
|
|||
##
|
||||
## little: The (smaller) string to find inside *big*.
|
||||
##
|
||||
## Returns: The location of *little* in *big* or 0 if *little* is not found in
|
||||
## Returns: The location of *little* in *big*, or 0 if *little* is not found in
|
||||
## *big*.
|
||||
##
|
||||
## .. bro:see:: find_all find_last
|
||||
|
|
@ -685,7 +685,7 @@ function subst_string%(s: string, from: string, to: string%): string
|
|||
## str: The string to convert to lowercase letters.
|
||||
##
|
||||
## Returns: A copy of the given string with the uppercase letters (as indicated
|
||||
## by ``isascii`` and \verb|isupper|``) folded to lowercase
|
||||
## by ``isascii`` and ``isupper``) folded to lowercase
|
||||
## (via ``tolower``).
|
||||
##
|
||||
## .. bro:see:: to_upper is_ascii
|
||||
|
|
@ -714,7 +714,7 @@ function to_lower%(str: string%): string
|
|||
## str: The string to convert to uppercase letters.
|
||||
##
|
||||
## Returns: A copy of the given string with the lowercase letters (as indicated
|
||||
## by ``isascii`` and \verb|islower|``) folded to uppercase
|
||||
## by ``isascii`` and ``islower``) folded to uppercase
|
||||
## (via ``toupper``).
|
||||
##
|
||||
## .. bro:see:: to_lower is_ascii
|
||||
|
|
@ -744,7 +744,7 @@ function to_upper%(str: string%): string
|
|||
## - ``NUL`` to ``\0``
|
||||
## - ``DEL`` to ``^?``
|
||||
## - values <= 26 to ``^[A-Z]``
|
||||
## - values not in *[32, 126]** to ``%XX``
|
||||
## - values not in *[32, 126]* to ``%XX``
|
||||
##
|
||||
## If the string does not yet have a trailing NUL, one is added.
|
||||
##
|
||||
|
|
@ -765,7 +765,7 @@ function clean%(str: string%): string
|
|||
## - ``NUL`` to ``\0``
|
||||
## - ``DEL`` to ``^?``
|
||||
## - values <= 26 to ``^[A-Z]``
|
||||
## - values not in *[32, 126]** to ``%XX``
|
||||
## - values not in *[32, 126]* to ``%XX``
|
||||
##
|
||||
## str: The string to escape.
|
||||
##
|
||||
|
|
@ -831,14 +831,16 @@ function string_to_ascii_hex%(s: string%): string
|
|||
return new StringVal(new BroString(1, (u_char*) x, s->Len() * 2));
|
||||
%}
|
||||
|
||||
## Uses the Smith Waterman algorithm to find similar/overlapping substrings.
|
||||
## Uses the Smith-Waterman algorithm to find similar/overlapping substrings.
|
||||
## See `Wikipedia <http://en.wikipedia.org/wiki/Smith%E2%80%93Waterman_algorithm>`_.
|
||||
##
|
||||
## s1: The first string.
|
||||
##
|
||||
## s2: The second string.
|
||||
##
|
||||
## Returns: The result of the Smit Waterman algorithm calculation.
|
||||
## params: Parameters for the Smith-Waterman algorithm.
|
||||
##
|
||||
## Returns: The result of the Smith-Waterman algorithm calculation.
|
||||
function str_smith_waterman%(s1: string, s2: string, params: sw_params%) : sw_substring_vec
|
||||
%{
|
||||
SWParams sw_params(params->AsRecordVal()->Lookup(0)->AsCount(),
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue