Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/robin/event-dumper'

Browse source 
Changes:

   - Changing semantics of the new_event() meta event: it's raised
     only for events that have a handler defined. There are too many
     checks in Bro that prevent events wo/ handler from being even
     prepared to raise to do that differently.

   - Adding test case.

* topic/robin/event-dumper:
  New script misc/dump-events.bro, along with core support, that dumps events Bro is raising in an easily readable form.
  Prettyfing Describe() for record types.
This commit is contained in:
Robin Sommer 2013-12-04 12:10:54 -08:00
commit dadfcde70e
14 changed files with 420 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/base/init-bare.bro
View file

@ -507,7 +507,7 @@ type script_id: record {
## directly and then remove this alias.
type id_table: table[string] of script_id;
## Meta-information about a record-field.
## Meta-information about a record field.
##
## .. bro:see:: record_fields record_field_table
type record_field: record {
@ -529,6 +529,25 @@ type record_field: record {
## directly and then remove this alias.
type record_field_table: table[string] of record_field;
## Meta-information about a parameter to a function/event.
##
## .. bro:see:: call_argument_vector new_event
type call_argument: record {
name: string; ##< The name of the parameter.
type_name: string; ##< The name of the parameters's type.
default_val: any &optional; ##< The value of the :bro:attr:`&default` attribute if defined.
## The value of the parameter as passed into a given call instance.
## Might be unset in the case a :bro:attr:`&default` attribute is
## defined.
value: any &optional;
};
## Vector type used to capture parameters of a function/event call.
##
## .. bro:see:: call_argument new_event
type call_argument_vector: vector of call_argument;
# todo:: Do we still need these here? Can they move into the packet filter
# framework?
#