Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 13:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Change http to https links in src and script files

Browse source
This commit is contained in:
Tim Wojtulewicz 2025-10-13 16:18:59 -07:00
parent 167aa5227f
commit dc982d9965
51 changed files with 276 additions and 285 deletions
Download patch file Download diff file Expand all files Collapse all files

16
doc/about.rst
View file

@ -139,9 +139,9 @@ History
======= =======
Zeek has a rich history stretching back to the 1990s. `Vern Paxson Zeek has a rich history stretching back to the 1990s. `Vern Paxson
<http://www.icir.org/vern/>`_ designed and implemented the initial version in <https://www.icir.org/vern/>`_ designed and implemented the initial version in
1995 as a researcher at the `Lawrence Berkeley National Laboratory (LBNL) 1995 as a researcher at the `Lawrence Berkeley National Laboratory (LBNL)
<http://www.lbl.gov/>`_. The original software was called “Bro,” as an <https://www.lbl.gov/>`_. The original software was called “Bro,” as an
“Orwellian reminder that monitoring comes hand in hand with the potential “Orwellian reminder that monitoring comes hand in hand with the potential
for privacy violations”. for privacy violations”.
@ -149,16 +149,16 @@ LBNL first deployed Zeek in 1996, and the USENIX Security Symposium published
Vern’s original paper on Zeek in 1998, and awarded it the Best Paper Award that Vern’s original paper on Zeek in 1998, and awarded it the Best Paper Award that
year He published a refined version of the paper in 1999 as `Bro: A System for year He published a refined version of the paper in 1999 as `Bro: A System for
Detecting Network Intruders in Real-Time Detecting Network Intruders in Real-Time
<http://www.icir.org/vern/papers/bro-CN99.pdf>`_. <https://www.icir.org/vern/papers/bro-CN99.pdf>`_.
In 2003, the `National Science Foundation (NSF) <http://www.nsf.gov/>`_ began In 2003, the `National Science Foundation (NSF) <https://www.nsf.gov/>`_ began
supporting research and advanced development on Bro at the `International supporting research and advanced development on Bro at the `International
Computer Science Institute (ICSI) <http://www.icsi.berkeley.edu/>`_. (Vern Computer Science Institute (ICSI) <https://www.icsi.berkeley.edu/>`_. (Vern
still leads the ICSI `Networking and Security group <http://www.icir.org/>`_.) still leads the ICSI `Networking and Security group <https://www.icir.org/>`_.)
Over the years, a growing team of ICSI researchers and students kept adding Over the years, a growing team of ICSI researchers and students kept adding
novel functions to Zeek, while LBNL continued its support with funding from the novel functions to Zeek, while LBNL continued its support with funding from the
`Department of Energy (DOE) <http://www.doe.gov/>`_. Much of Zeek’s `Department of Energy (DOE) <https://www.doe.gov/>`_. Much of Zeek’s
capabilities originate in academic research projects, with results often capabilities originate in academic research projects, with results often
published at top-tier conferences. A key to Zeek’s success was the project’s published at top-tier conferences. A key to Zeek’s success was the project’s
ability to bridge the gap between academia and operations. This relationship ability to bridge the gap between academia and operations. This relationship
@ -172,7 +172,7 @@ As a result, deploying Zeek required overcoming a steep learning curve.
In 2010, NSF sought to address this challenge by awarding ICSI a grant from its In 2010, NSF sought to address this challenge by awarding ICSI a grant from its
Software Development for Cyberinfrastructure fund. The `National Center for Software Development for Cyberinfrastructure fund. The `National Center for
Supercomputing Applications (NCSA) <http://www.ncsa.illinois.edu/>`_ joined the Supercomputing Applications (NCSA) <https://www.ncsa.illinois.edu/>`_ joined the
team as a core partner, and the Zeek project began to overhaul many of the team as a core partner, and the Zeek project began to overhaul many of the
user-visible parts of the system for the 2.0 release in 2012. user-visible parts of the system for the 2.0 release in 2012.

2
doc/frameworks/signatures.rst
View file

@ -433,7 +433,7 @@ Things to keep in mind when writing signatures
signature engine and can be matched with ``\r`` and ``\n``, signature engine and can be matched with ``\r`` and ``\n``,
respectively. Generally, Zeek follows `flex's regular expression respectively. Generally, Zeek follows `flex's regular expression
syntax syntax
<http://westes.github.io/flex/manual/Patterns.html>`_. <https://westes.github.io/flex/manual/Patterns.html>`_.
See the DPD signatures in ``base/frameworks/dpd/dpd.sig`` for some examples See the DPD signatures in ``base/frameworks/dpd/dpd.sig`` for some examples
of fairly complex payload patterns. of fairly complex payload patterns.

4
doc/script-reference/autogenerated-file-analyzer-index.rst
View file

@ -472,7 +472,7 @@ Events
Generated for encountered X509 certificates, e.g., in the clear SSL/TLS Generated for encountered X509 certificates, e.g., in the clear SSL/TLS
connection handshake. connection handshake.
See `Wikipedia <http://en.wikipedia.org/wiki/X.509>`__ for more information See `Wikipedia <https://en.wikipedia.org/wiki/X.509>`__ for more information
about the X.509 format. about the X.509 format.
@ -496,7 +496,7 @@ Events
Generated for X509 extensions seen in a certificate. Generated for X509 extensions seen in a certificate.
See `Wikipedia <http://en.wikipedia.org/wiki/X.509>`__ for more information See `Wikipedia <https://en.wikipedia.org/wiki/X.509>`__ for more information
about the X.509 format. about the X.509 format.

4
scripts/base/frameworks/openflow/consts.zeek
View file

@ -23,7 +23,7 @@ const COOKIE_UID_START = 0;
export { export {
# All ethertypes can be found at # All ethertypes can be found at
# http://standards.ieee.org/develop/regauth/ethertype/eth.txt # https://standards.ieee.org/develop/regauth/ethertype/eth.txt
# but are not interesting for us at this point # but are not interesting for us at this point
#type ethertype: enum { #type ethertype: enum {
# Internet protocol version 4 # Internet protocol version 4
@ -69,7 +69,7 @@ export {
#}; #};
# A list of ip protocol numbers can be found at # A list of ip protocol numbers can be found at
# http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers # https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
#type iptype: enum { #type iptype: enum {
# IPv6 Hop-by-Hop Option (RFC2460) # IPv6 Hop-by-Hop Option (RFC2460)
const IP_HOPOPT = 0x00; const IP_HOPOPT = 0x00;

4
scripts/base/init-bare.zeek
View file

@ -1552,7 +1552,7 @@ const mmdb_stale_check_interval: interval = 5min &redef;
## Computed entropy values. The record captures a number of measures that are ## Computed entropy values. The record captures a number of measures that are
## computed in parallel. See `A Pseudorandom Number Sequence Test Program ## computed in parallel. See `A Pseudorandom Number Sequence Test Program
## <http://www.fourmilab.ch/random>`_ for more information, Zeek uses the same ## <https://www.fourmilab.ch/random>`_ for more information, Zeek uses the same
## code. ## code.
## ##
## .. zeek:see:: entropy_test_add entropy_test_finish entropy_test_init find_entropy ## .. zeek:see:: entropy_test_add entropy_test_finish entropy_test_init find_entropy
@ -3247,7 +3247,7 @@ type bittorrent_peer: record {
type bittorrent_peer_set: set[bittorrent_peer]; type bittorrent_peer_set: set[bittorrent_peer];
## BitTorrent "benc" value. Note that "benc" = Bencode ("Bee-Encode"), per ## BitTorrent "benc" value. Note that "benc" = Bencode ("Bee-Encode"), per
## http://en.wikipedia.org/wiki/Bencode. ## https://en.wikipedia.org/wiki/Bencode.
## ##
## .. zeek:see:: bittorrent_benc_dir ## .. zeek:see:: bittorrent_benc_dir
type bittorrent_benc_value: record { type bittorrent_benc_value: record {

4
scripts/base/protocols/finger/spicy-events.zeek
View file

@ -4,7 +4,7 @@
## Generated for Finger requests. ## Generated for Finger requests.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Finger_protocol>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Finger_protocol>`__ for more
## information about the Finger protocol. ## information about the Finger protocol.
## ##
## c: The connection. ## c: The connection.
@ -20,7 +20,7 @@ global finger_request: event(c: connection, full: bool, username: string, hostna
## Generated for Finger replies. ## Generated for Finger replies.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Finger_protocol>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Finger_protocol>`__ for more
## information about the Finger protocol. ## information about the Finger protocol.
## ##
## c: The connection. ## c: The connection.

2
scripts/base/protocols/http/dpd.sig
View file

@ -1,5 +1,5 @@
# List of HTTP headers pulled from: # List of HTTP headers pulled from:
# http://annevankesteren.nl/2007/10/http-methods # https://annevankesteren.nl/2007/10/http-methods
# #
# We match each side of the connection independently to avoid missing # We match each side of the connection independently to avoid missing
# large HTTP sessions where one side exceeds the DPD buffer size on # large HTTP sessions where one side exceeds the DPD buffer size on

4
scripts/base/protocols/rdp/consts.zeek
View file

@ -1,7 +1,7 @@
module RDP; module RDP;
export { export {
# http://www.c-amie.co.uk/technical/mstsc-versions/ # https://www.c-amie.co.uk/technical/mstsc-versions/
const builds = { const builds = {
[0419] = "RDP 4.0", [0419] = "RDP 4.0",
[2195] = "RDP 5.0", [2195] = "RDP 5.0",
@ -79,7 +79,7 @@ export {
[4] = "Locked conference", [4] = "Locked conference",
} &default = function(n: count): string { return fmt("result-%d", n); }; } &default = function(n: count): string { return fmt("result-%d", n); };
# http://msdn.microsoft.com/en-us/goglobal/bb964664.aspx # https://msdn.microsoft.com/en-us/goglobal/bb964664.aspx
# https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-language-pack-default-values # https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-language-pack-default-values
const languages = { const languages = {
[1078] = "Afrikaans - South Africa", [1078] = "Afrikaans - South Africa",

8
scripts/base/protocols/ssl/consts.zeek
View file

@ -149,7 +149,7 @@ export {
# Map SSL Extension values to consts for easier readability of code. # Map SSL Extension values to consts for easier readability of code.
# More information can be found here: # More information can be found here:
# http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xml # https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xml
const SSL_EXTENSION_SERVER_NAME = 0; const SSL_EXTENSION_SERVER_NAME = 0;
const SSL_EXTENSION_MAX_FRAGMENT_LENGTH = 1; const SSL_EXTENSION_MAX_FRAGMENT_LENGTH = 1;
const SSL_EXTENSION_CLIENT_CERTIFICATE_URL = 2; const SSL_EXTENSION_CLIENT_CERTIFICATE_URL = 2;
@ -227,7 +227,7 @@ export {
## Mapping between numeric codes and human readable strings for SSL/TLS ## Mapping between numeric codes and human readable strings for SSL/TLS
## extensions. ## extensions.
# More information can be found here: # More information can be found here:
# http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xml # https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xml
const extensions: table[count] of string = { const extensions: table[count] of string = {
[0] = "server_name", [0] = "server_name",
[1] = "max_fragment_length", [1] = "max_fragment_length",
@ -322,7 +322,7 @@ export {
} &default=function(i: count):string { return fmt("unknown-%d", i); }; } &default=function(i: count):string { return fmt("unknown-%d", i); };
## Mapping between numeric codes and human readable string for SSL/TLS elliptic curves. ## Mapping between numeric codes and human readable string for SSL/TLS elliptic curves.
# See http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 # See https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
const ec_curves: table[count] of string = { const ec_curves: table[count] of string = {
[1] = "sect163k1", # 1-23 are TLS 1.3 obsoleted [1] = "sect163k1", # 1-23 are TLS 1.3 obsoleted
[2] = "sect163r1", [2] = "sect163r1",
@ -404,7 +404,7 @@ export {
} &default=function(i: count):string { return fmt("unknown-%d", i); }; } &default=function(i: count):string { return fmt("unknown-%d", i); };
## Mapping between numeric codes and human readable string for SSL/TLS EC point formats. ## Mapping between numeric codes and human readable string for SSL/TLS EC point formats.
# See http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-9 # See https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-9
const ec_point_formats: table[count] of string = { const ec_point_formats: table[count] of string = {
[0] = "uncompressed", [0] = "uncompressed",
[1] = "ansiX962_compressed_prime", [1] = "ansiX962_compressed_prime",

2
scripts/base/protocols/ssl/mozilla-ca-list.zeek
View file

@ -6,7 +6,7 @@
# #
# This Source Code Form is subject to the terms of the Mozilla Public # This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this # License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/. # file, You can obtain one at https://mozilla.org/MPL/2.0/.
@load base/protocols/ssl @load base/protocols/ssl
module SSL; module SSL;

2
scripts/base/protocols/syslog/spicy-events.zeek
View file

@ -4,7 +4,7 @@
## Generated for monitored Syslog messages. ## Generated for monitored Syslog messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Syslog>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Syslog>`__ for more
## information about the Syslog protocol. ## information about the Syslog protocol.
## ##
## c: The connection record for the underlying transport-layer session/flow. ## c: The connection record for the underlying transport-layer session/flow.

2
scripts/policy/protocols/ssl/heartbleed.zeek
View file

@ -1,4 +1,4 @@
##! Detect the TLS heartbleed attack. See http://heartbleed.com for more. ##! Detect the TLS heartbleed attack. See https://heartbleed.com for more.
@load base/protocols/ssl @load base/protocols/ssl
@load base/frameworks/notice @load base/frameworks/notice

2
scripts/zeekygen/example.zeek
View file

@ -5,7 +5,7 @@
##! ##!
##! Comments in the from ``##!`` are meant to summarize the script's ##! Comments in the from ``##!`` are meant to summarize the script's
##! purpose. They are transferred directly into the generated ##! purpose. They are transferred directly into the generated
##! `reStructuredText <http://docutils.sourceforge.net/rst.html>`_ ##! `reStructuredText <https://docutils.sourceforge.net/rst.html>`_
##! (reST) document associated with the script. ##! (reST) document associated with the script.
##! ##!
##! .. tip:: You can embed directives and roles within ``##``-stylized comments. ##! .. tip:: You can embed directives and roles within ``##``-stylized comments.

2
src/analyzer/protocol/bittorrent/BitTorrentTracker.h
View file

@ -31,7 +31,7 @@ enum BTT_States : uint8_t {
BTT_RES_DONE BTT_RES_DONE
}; };
// "benc" = Bencode ("Bee-Encode"), per http://en.wikipedia.org/wiki/Bencode // "benc" = Bencode ("Bee-Encode"), per https://en.wikipedia.org/wiki/Bencode
enum BTT_BencTypes : uint8_t { enum BTT_BencTypes : uint8_t {
BENC_TYPE_INT = 0, BENC_TYPE_INT = 0,
BENC_TYPE_STR = 1, BENC_TYPE_STR = 1,

37
src/analyzer/protocol/bittorrent/events.bif
View file

@ -1,6 +1,6 @@
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -13,7 +13,7 @@ event bittorrent_peer_handshake%(c: connection, is_orig: bool,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -25,7 +25,7 @@ event bittorrent_peer_keep_alive%(c: connection, is_orig: bool%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel
@ -37,7 +37,7 @@ event bittorrent_peer_choke%(c: connection, is_orig: bool%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -49,7 +49,7 @@ event bittorrent_peer_unchoke%(c: connection, is_orig: bool%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -61,7 +61,7 @@ event bittorrent_peer_interested%(c: connection, is_orig: bool%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -73,7 +73,7 @@ event bittorrent_peer_not_interested%(c: connection, is_orig: bool%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -85,7 +85,7 @@ event bittorrent_peer_have%(c: connection, is_orig: bool, piece_index: count%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_cancel bittorrent_peer_choke bittorrent_peer_handshake ## .. zeek:see:: bittorrent_peer_cancel bittorrent_peer_choke bittorrent_peer_handshake
@ -97,7 +97,7 @@ event bittorrent_peer_bitfield%(c: connection, is_orig: bool, bitfield: string%)
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -110,7 +110,7 @@ event bittorrent_peer_request%(c: connection, is_orig: bool, index: count,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -123,7 +123,7 @@ event bittorrent_peer_piece%(c: connection, is_orig: bool, index: count,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_choke
@ -136,7 +136,7 @@ event bittorrent_peer_cancel%(c: connection, is_orig: bool, index: count,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -148,7 +148,7 @@ event bittorrent_peer_port%(c: connection, is_orig: bool, listen_port: port%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -161,7 +161,7 @@ event bittorrent_peer_unknown%(c: connection, is_orig: bool, message_id: count,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -173,7 +173,7 @@ event bittorrent_peer_weird%(c: connection, is_orig: bool, msg: string%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -186,7 +186,7 @@ event bt_tracker_request%(c: connection, uri: string,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -201,7 +201,7 @@ event bt_tracker_response%(c: connection, status: count,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -214,7 +214,7 @@ event bt_tracker_response_not_ok%(c: connection, status: count,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
## more information about the BitTorrent protocol. ## more information about the BitTorrent protocol.
## ##
## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke ## .. zeek:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
@ -223,4 +223,3 @@ event bt_tracker_response_not_ok%(c: connection, status: count,
## bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke ## bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
## bittorrent_peer_unknown bittorrent_peer_weird ## bittorrent_peer_unknown bittorrent_peer_weird
event bt_tracker_weird%(c: connection, is_orig: bool, msg: string%); event bt_tracker_weird%(c: connection, is_orig: bool, msg: string%);

48
src/analyzer/protocol/dns/events.bif
View file

@ -1,6 +1,6 @@
## Generated for all DNS messages. ## Generated for all DNS messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -25,7 +25,7 @@ event dns_message%(c: connection, is_orig: bool, msg: dns_msg, len: count%);
## Generated for DNS requests. For requests with multiple queries, this event ## Generated for DNS requests. For requests with multiple queries, this event
## is raised once for each. ## is raised once for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -57,7 +57,7 @@ event dns_request%(c: connection, msg: dns_msg, query: string, qtype: count, qcl
## answers to a query. Note that all of the event's parameters are parsed out of ## answers to a query. Note that all of the event's parameters are parsed out of
## the reply; there's no stateful correlation with the query. ## the reply; there's no stateful correlation with the query.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -86,7 +86,7 @@ event dns_rejected%(c: connection, msg: dns_msg, query: string, qtype: count, qc
## Generated for each entry in the Question section of a DNS reply. ## Generated for each entry in the Question section of a DNS reply.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -118,7 +118,7 @@ event dns_query_reply%(c: connection, msg: dns_msg, query: string,
## Generated for DNS replies of type *A*. For replies with multiple answers, an ## Generated for DNS replies of type *A*. For replies with multiple answers, an
## individual event of the corresponding type is raised for each. ## individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -143,7 +143,7 @@ event dns_A_reply%(c: connection, msg: dns_msg, ans: dns_answer, a: addr%);
## Generated for DNS replies of type *AAAA*. For replies with multiple answers, ## Generated for DNS replies of type *AAAA*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -168,7 +168,7 @@ event dns_AAAA_reply%(c: connection, msg: dns_msg, ans: dns_answer, a: addr%);
## Generated for DNS replies of type *A6*. For replies with multiple answers, an ## Generated for DNS replies of type *A6*. For replies with multiple answers, an
## individual event of the corresponding type is raised for each. ## individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -193,7 +193,7 @@ event dns_A6_reply%(c: connection, msg: dns_msg, ans: dns_answer, a: addr%);
## Generated for DNS replies of type *NS*. For replies with multiple answers, an ## Generated for DNS replies of type *NS*. For replies with multiple answers, an
## individual event of the corresponding type is raised for each. ## individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -218,7 +218,7 @@ event dns_NS_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string%)
## Generated for DNS replies of type *CNAME*. For replies with multiple answers, ## Generated for DNS replies of type *CNAME*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -243,7 +243,7 @@ event dns_CNAME_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: strin
## Generated for DNS replies of type *PTR*. For replies with multiple answers, ## Generated for DNS replies of type *PTR*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -268,7 +268,7 @@ event dns_PTR_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string%
## Generated for DNS replies of type *CNAME*. For replies with multiple answers, ## Generated for DNS replies of type *CNAME*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -293,7 +293,7 @@ event dns_SOA_reply%(c: connection, msg: dns_msg, ans: dns_answer, soa: dns_soa%
## Generated for DNS replies of type *WKS*. For replies with multiple answers, ## Generated for DNS replies of type *WKS*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -316,7 +316,7 @@ event dns_WKS_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
## Generated for DNS replies of type *HINFO*. For replies with multiple answers, ## Generated for DNS replies of type *HINFO*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -339,7 +339,7 @@ event dns_HINFO_reply%(c: connection, msg: dns_msg, ans: dns_answer, cpu: string
## Generated for DNS replies of type *MX*. For replies with multiple answers, an ## Generated for DNS replies of type *MX*. For replies with multiple answers, an
## individual event of the corresponding type is raised for each. ## individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -366,7 +366,7 @@ event dns_MX_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string,
## Generated for DNS replies of type *TXT*. For replies with multiple answers, ## Generated for DNS replies of type *TXT*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -391,7 +391,7 @@ event dns_TXT_reply%(c: connection, msg: dns_msg, ans: dns_answer, strs: string_
## Generated for DNS replies of type *SPF*. For replies with multiple answers, ## Generated for DNS replies of type *SPF*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -435,7 +435,7 @@ event dns_CAA_reply%(c: connection, msg: dns_msg, ans: dns_answer, flags: count,
## Generated for DNS replies of type *SRV*. For replies with multiple answers, ## Generated for DNS replies of type *SRV*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -502,7 +502,7 @@ event dns_unknown_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
## Generated for DNS replies of type *EDNS*. For replies with multiple answers, ## Generated for DNS replies of type *EDNS*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -530,7 +530,7 @@ event dns_EDNS_addl%(c: connection, msg: dns_msg, ans: dns_edns_additional%);
## Generated for DNS replies of type *EDNS*. For replies with multiple options, ## Generated for DNS replies of type *EDNS*. For replies with multiple options,
## an individual event is raised for each. ## an individual event is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -559,7 +559,7 @@ event dns_EDNS_ecs%(c: connection, msg: dns_msg, opt: dns_edns_ecs%);
## an opt-type of 11. For replies with multiple option fields, an individual event is ## an opt-type of 11. For replies with multiple option fields, an individual event is
## raised for each. ## raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. See `RFC7828 <https://tools.ietf.org/html/rfc7828>`__ for ## information about the DNS protocol. See `RFC7828 <https://tools.ietf.org/html/rfc7828>`__ for
## more information about EDNS0 TCP keepalive. Zeek analyzes both UDP and TCP DNS ## more information about EDNS0 TCP keepalive. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
@ -589,7 +589,7 @@ event dns_EDNS_tcp_keepalive%(c: connection, msg: dns_msg, opt: dns_edns_tcp_kee
## an opt-type of 10. For replies with multiple options fields, an individual event ## an opt-type of 10. For replies with multiple options fields, an individual event
## is raised for each. ## is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. See `RFC7873 <https://tools.ietf.org/html/rfc7873>`__ for ## information about the DNS protocol. See `RFC7873 <https://tools.ietf.org/html/rfc7873>`__ for
## more information about EDNS0 cookie. Zeek analyzes both UDP and TCP DNS ## more information about EDNS0 cookie. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
@ -618,7 +618,7 @@ event dns_EDNS_cookie%(c: connection, msg: dns_msg, opt: dns_edns_cookie%);
## Generated for DNS replies of type *TKEY*. For replies with multiple answers, ## Generated for DNS replies of type *TKEY*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. See `RFC2930 <https://tools.ietf.org/html/rfc2930>`__ ## information about the DNS protocol. See `RFC2930 <https://tools.ietf.org/html/rfc2930>`__
## for more information about TKEY. Zeek analyzes both UDP and TCP DNS sessions. ## for more information about TKEY. Zeek analyzes both UDP and TCP DNS sessions.
## ##
@ -640,7 +640,7 @@ event dns_TKEY%(c: connection, msg: dns_msg, ans: dns_tkey%);
## Generated for DNS replies of type *TSIG*. For replies with multiple answers, ## Generated for DNS replies of type *TSIG*. For replies with multiple answers,
## an individual event of the corresponding type is raised for each. ## an individual event of the corresponding type is raised for each.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##
@ -819,7 +819,7 @@ event dns_HTTPS%(c: connection, msg: dns_msg, ans: dns_answer, https: dns_svcb_r
## ``dns_*`` event that will be raised for a DNS query/reply and signals that ## ``dns_*`` event that will be raised for a DNS query/reply and signals that
## all resource records have been passed on. ## all resource records have been passed on.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS ## information about the DNS protocol. Zeek analyzes both UDP and TCP DNS
## sessions. ## sessions.
## ##

5
src/analyzer/protocol/finger/legacy/events.bif
View file

@ -1,6 +1,6 @@
## Generated for Finger requests. ## Generated for Finger requests.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Finger_protocol>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Finger_protocol>`__ for more
## information about the Finger protocol. ## information about the Finger protocol.
## ##
## c: The connection. ## c: The connection.
@ -21,7 +21,7 @@ event finger_request%(c: connection, full: bool, username: string, hostname: str
## Generated for Finger replies. ## Generated for Finger replies.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Finger_protocol>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Finger_protocol>`__ for more
## information about the Finger protocol. ## information about the Finger protocol.
## ##
## c: The connection. ## c: The connection.
@ -35,4 +35,3 @@ event finger_request%(c: connection, full: bool, username: string, hostname: str
## been ported. To still enable this event, one needs to ## been ported. To still enable this event, one needs to
## register a port for it or add a DPD payload signature. ## register a port for it or add a DPD payload signature.
event finger_reply%(c: connection, reply_line: string%); event finger_reply%(c: connection, reply_line: string%);

4
src/analyzer/protocol/ftp/events.bif
View file

@ -1,6 +1,6 @@
## Generated for client-side FTP commands. ## Generated for client-side FTP commands.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/File_Transfer_Protocol>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/File_Transfer_Protocol>`__ for
## more information about the FTP protocol. ## more information about the FTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -15,7 +15,7 @@ event ftp_request%(c: connection, command: string, arg: string%);
## Generated for server-side FTP replies. ## Generated for server-side FTP replies.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/File_Transfer_Protocol>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/File_Transfer_Protocol>`__ for
## more information about the FTP protocol. ## more information about the FTP protocol.
## ##
## c: The connection. ## c: The connection.

12
src/analyzer/protocol/gnutella/events.bif
View file

@ -1,6 +1,6 @@
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Gnutella>`__ for more
## information about the Gnutella protocol. ## information about the Gnutella protocol.
## ##
## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify ## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify
@ -15,7 +15,7 @@ event gnutella_text_msg%(c: connection, orig: bool, headers: string%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Gnutella>`__ for more
## information about the Gnutella protocol. ## information about the Gnutella protocol.
## ##
## .. zeek:see:: gnutella_establish gnutella_http_notify gnutella_not_establish ## .. zeek:see:: gnutella_establish gnutella_http_notify gnutella_not_establish
@ -32,7 +32,7 @@ event gnutella_binary_msg%(c: connection, orig: bool, msg_type: count,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Gnutella>`__ for more
## information about the Gnutella protocol. ## information about the Gnutella protocol.
## ##
## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify ## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify
@ -47,7 +47,7 @@ event gnutella_partial_binary_msg%(c: connection, orig: bool,
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Gnutella>`__ for more
## information about the Gnutella protocol. ## information about the Gnutella protocol.
## ##
## .. zeek:see:: gnutella_binary_msg gnutella_http_notify gnutella_not_establish ## .. zeek:see:: gnutella_binary_msg gnutella_http_notify gnutella_not_establish
@ -61,7 +61,7 @@ event gnutella_establish%(c: connection%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Gnutella>`__ for more
## information about the Gnutella protocol. ## information about the Gnutella protocol.
## ##
## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify ## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify
@ -75,7 +75,7 @@ event gnutella_not_establish%(c: connection%);
## TODO. ## TODO.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Gnutella>`__ for more
## information about the Gnutella protocol. ## information about the Gnutella protocol.
## ##
## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_not_establish ## .. zeek:see:: gnutella_binary_msg gnutella_establish gnutella_not_establish

20
src/analyzer/protocol/http/events.bif
View file

@ -4,7 +4,7 @@
## dialogues. This event is generated as soon as a request's initial line has ## dialogues. This event is generated as soon as a request's initial line has
## been parsed, and before any :zeek:id:`http_header` events are raised. ## been parsed, and before any :zeek:id:`http_header` events are raised.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -27,7 +27,7 @@ event http_request%(c: connection, method: string, original_URI: string, unescap
## dialogues. This event is generated as soon as a reply's initial line has ## dialogues. This event is generated as soon as a reply's initial line has
## been parsed, and before any :zeek:id:`http_header` events are raised. ## been parsed, and before any :zeek:id:`http_header` events are raised.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -47,7 +47,7 @@ event http_reply%(c: connection, version: string, code: count, reason: string%);
## sessions and raises corresponding events as it parses client/server ## sessions and raises corresponding events as it parses client/server
## dialogues. ## dialogues.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -73,7 +73,7 @@ event http_header%(c: connection, is_orig: bool, name: string, value: string%);
## once. Zeek supports persistent and pipelined HTTP sessions and raises ## once. Zeek supports persistent and pipelined HTTP sessions and raises
## corresponding events as it parses client/server dialogues. ## corresponding events as it parses client/server dialogues.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -98,7 +98,7 @@ event http_all_headers%(c: connection, is_orig: bool, hlist: mime_header_list%);
## entities. Zeek raises this event just before it starts parsing each entity's ## entities. Zeek raises this event just before it starts parsing each entity's
## content. ## content.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -117,7 +117,7 @@ event http_begin_entity%(c: connection, is_orig: bool%);
## entities. Zeek raises this event at the point when it has finished parsing an ## entities. Zeek raises this event at the point when it has finished parsing an
## entity's content. ## entity's content.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -141,7 +141,7 @@ event http_end_entity%(c: connection, is_orig: bool%);
## can be quite expensive for HTTP tranders. At the very least, one should ## can be quite expensive for HTTP tranders. At the very least, one should
## impose an upper size limit on how much data is being buffered. ## impose an upper size limit on how much data is being buffered.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -164,7 +164,7 @@ event http_entity_data%(c: connection, is_orig: bool, length: count, data: strin
## type as specified by the ``Content-Type`` header. If that header is ## type as specified by the ``Content-Type`` header. If that header is
## missing, this event is still raised with a default value of ``text/plain``. ## missing, this event is still raised with a default value of ``text/plain``.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -192,7 +192,7 @@ event http_content_type%(c: connection, is_orig: bool, ty: string, subty: string
## message have been processed (and their corresponding ``http_entity_*`` events ## message have been processed (and their corresponding ``http_entity_*`` events
## generated). ## generated).
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -209,7 +209,7 @@ event http_message_done%(c: connection, is_orig: bool, stat: http_message_stat%)
## Generated for errors found when decoding HTTP requests or replies. ## Generated for errors found when decoding HTTP requests or replies.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
## for more information about the HTTP protocol. ## for more information about the HTTP protocol.
## ##
## c: The connection. ## c: The connection.

7
src/analyzer/protocol/ident/events.bif
View file

@ -1,6 +1,6 @@
## Generated for Ident requests. ## Generated for Ident requests.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/ident_protocol>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/ident_protocol>`__ for more
## information about the Ident protocol. ## information about the Ident protocol.
## ##
## c: The connection. ## c: The connection.
@ -19,7 +19,7 @@ event ident_request%(c: connection, lport: port, rport: port%);
## Generated for Ident replies. ## Generated for Ident replies.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/ident_protocol>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/ident_protocol>`__ for more
## information about the Ident protocol. ## information about the Ident protocol.
## ##
## c: The connection. ## c: The connection.
@ -42,7 +42,7 @@ event ident_reply%(c: connection, lport: port, rport: port, user_id: string, sys
## Generated for Ident error replies. ## Generated for Ident error replies.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/ident_protocol>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/ident_protocol>`__ for more
## information about the Ident protocol. ## information about the Ident protocol.
## ##
## c: The connection. ## c: The connection.
@ -60,4 +60,3 @@ event ident_reply%(c: connection, lport: port, rport: port, user_id: string, sys
## been ported. To still enable this event, one needs to ## been ported. To still enable this event, one needs to
## register a port for it or add a DPD payload signature. ## register a port for it or add a DPD payload signature.
event ident_error%(c: connection, lport: port, rport: port, line: string%); event ident_error%(c: connection, lport: port, rport: port, line: string%);

68
src/analyzer/protocol/irc/events.bif
View file

@ -1,7 +1,7 @@
## Generated for all client-side IRC commands. ## Generated for all client-side IRC commands.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -30,7 +30,7 @@ event irc_request%(c: connection, is_orig: bool, prefix: string,
## Generated for all IRC replies. IRC replies are sent in response to a ## Generated for all IRC replies. IRC replies are sent in response to a
## request and come with a reply code. ## request and come with a reply code.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -55,7 +55,7 @@ event irc_reply%(c: connection, is_orig: bool, prefix: string,
## Generated for IRC commands forwarded from the server to the client. ## Generated for IRC commands forwarded from the server to the client.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -86,7 +86,7 @@ event irc_message%(c: connection, is_orig: bool, prefix: string,
## Generated for IRC messages of type *quit*. This event is generated for ## Generated for IRC messages of type *quit*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -108,7 +108,7 @@ event irc_quit_message%(c: connection, is_orig: bool, nick: string, message: str
## Generated for IRC messages of type *privmsg*. This event is generated for ## Generated for IRC messages of type *privmsg*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -133,7 +133,7 @@ event irc_privmsg_message%(c: connection, is_orig: bool, source: string,
## Generated for IRC messages of type *notice*. This event is generated for ## Generated for IRC messages of type *notice*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -158,7 +158,7 @@ event irc_notice_message%(c: connection, is_orig: bool, source: string,
## Generated for IRC messages of type *squery*. This event is generated for ## Generated for IRC messages of type *squery*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -183,7 +183,7 @@ event irc_squery_message%(c: connection, is_orig: bool, source: string,
## Generated for IRC messages of type *join*. This event is generated for ## Generated for IRC messages of type *join*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -203,7 +203,7 @@ event irc_join_message%(c: connection, is_orig: bool, info_list: irc_join_list%)
## Generated for IRC messages of type *part*. This event is generated for ## Generated for IRC messages of type *part*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -228,7 +228,7 @@ event irc_part_message%(c: connection, is_orig: bool, nick: string,
## Generated for IRC messages of type *nick*. This event is generated for ## Generated for IRC messages of type *nick*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -249,7 +249,7 @@ event irc_nick_message%(c: connection, is_orig: bool, who: string, newnick: stri
## Generated when a server rejects an IRC nickname. ## Generated when a server rejects an IRC nickname.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -266,7 +266,7 @@ event irc_invalid_nick%(c: connection, is_orig: bool%);
## Generated for an IRC reply of type *luserclient*. ## Generated for an IRC reply of type *luserclient*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -290,7 +290,7 @@ event irc_network_info%(c: connection, is_orig: bool, users: count,
## Generated for an IRC reply of type *luserme*. ## Generated for an IRC reply of type *luserme*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -314,7 +314,7 @@ event irc_server_info%(c: connection, is_orig: bool, users: count,
## Generated for an IRC reply of type *luserchannels*. ## Generated for an IRC reply of type *luserchannels*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -333,7 +333,7 @@ event irc_channel_info%(c: connection, is_orig: bool, chans: count%);
## Generated for an IRC reply of type *whoreply*. ## Generated for an IRC reply of type *whoreply*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -372,7 +372,7 @@ event irc_who_line%(c: connection, is_orig: bool, target_nick: string,
## Generated for an IRC reply of type *namereply*. ## Generated for an IRC reply of type *namereply*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -396,7 +396,7 @@ event irc_names_info%(c: connection, is_orig: bool, c_type: string,
## Generated for an IRC reply of type *whoisoperator*. ## Generated for an IRC reply of type *whoisoperator*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -415,7 +415,7 @@ event irc_whois_operator_line%(c: connection, is_orig: bool, nick: string%);
## Generated for an IRC reply of type *whoischannels*. ## Generated for an IRC reply of type *whoischannels*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -437,7 +437,7 @@ event irc_whois_channel_line%(c: connection, is_orig: bool, nick: string,
## Generated for an IRC reply of type *whoisuser*. ## Generated for an IRC reply of type *whoisuser*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -463,7 +463,7 @@ event irc_whois_user_line%(c: connection, is_orig: bool, nick: string,
## Generated for IRC replies of type *youreoper* and *nooperhost*. ## Generated for IRC replies of type *youreoper* and *nooperhost*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -483,7 +483,7 @@ event irc_oper_response%(c: connection, is_orig: bool, got_oper: bool%);
## Generated for an IRC reply of type *globalusers*. ## Generated for an IRC reply of type *globalusers*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -505,7 +505,7 @@ event irc_global_users%(c: connection, is_orig: bool, prefix: string, msg: strin
## Generated for an IRC reply of type *topic*. ## Generated for an IRC reply of type *topic*.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -527,7 +527,7 @@ event irc_channel_topic%(c: connection, is_orig: bool, channel: string, topic: s
## Generated for IRC messages of type *who*. This event is generated for ## Generated for IRC messages of type *who*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -549,7 +549,7 @@ event irc_who_message%(c: connection, is_orig: bool, mask: string, oper: bool%);
## Generated for IRC messages of type *whois*. This event is generated for ## Generated for IRC messages of type *whois*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -571,7 +571,7 @@ event irc_whois_message%(c: connection, is_orig: bool, server: string, users: st
## Generated for IRC messages of type *oper*. This event is generated for ## Generated for IRC messages of type *oper*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -593,7 +593,7 @@ event irc_oper_message%(c: connection, is_orig: bool, user: string, password: st
## Generated for IRC messages of type *kick*. This event is generated for ## Generated for IRC messages of type *kick*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -621,7 +621,7 @@ event irc_kick_message%(c: connection, is_orig: bool, prefix: string,
## Generated for IRC messages of type *error*. This event is generated for ## Generated for IRC messages of type *error*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -644,7 +644,7 @@ event irc_error_message%(c: connection, is_orig: bool, prefix: string, message:
## Generated for IRC messages of type *invite*. This event is generated for ## Generated for IRC messages of type *invite*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -670,7 +670,7 @@ event irc_invite_message%(c: connection, is_orig: bool, prefix: string,
## Generated for IRC messages of type *mode*. This event is generated for ## Generated for IRC messages of type *mode*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -693,7 +693,7 @@ event irc_mode_message%(c: connection, is_orig: bool, prefix: string, params: st
## Generated for IRC messages of type *squit*. This event is generated for ## Generated for IRC messages of type *squit*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -719,7 +719,7 @@ event irc_squit_message%(c: connection, is_orig: bool, prefix: string,
## Generated for IRC messages of type *dcc*. This event is generated for ## Generated for IRC messages of type *dcc*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## See `Wikipedia <https://en.wikipedia.org/wiki/Direct_Client-to-Client>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Direct_Client-to-Client>`__ for more
@ -758,7 +758,7 @@ event irc_dcc_message%(c: connection, is_orig: bool,
## Generated for IRC messages of type *dcc*. This event is generated for ## Generated for IRC messages of type *dcc*. This event is generated for
## DCC SEND acknowledge message. ## DCC SEND acknowledge message.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## See `Wikipedia <https://en.wikipedia.org/wiki/Direct_Client-to-Client>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Direct_Client-to-Client>`__ for more
@ -778,7 +778,7 @@ event irc_dcc_send_ack%(c: connection, bytes_received: count%);
## Generated for IRC messages of type *user*. This event is generated for ## Generated for IRC messages of type *user*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.
@ -804,7 +804,7 @@ event irc_user_message%(c: connection, is_orig: bool, user: string, host: string
## Generated for IRC messages of type *password*. This event is generated for ## Generated for IRC messages of type *password*. This event is generated for
## messages coming from both the client and the server. ## messages coming from both the client and the server.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Internet_Relay_Chat>`__ for more
## information about the IRC protocol. ## information about the IRC protocol.
## ##
## c: The connection. ## c: The connection.

20
src/analyzer/protocol/krb/events.bif
View file

@ -4,7 +4,7 @@
## encrypted Ticket Granting Ticket (TGT) for that user. The TGT ## encrypted Ticket Granting Ticket (TGT) for that user. The TGT
## can then be used to request further tickets for other services. ## can then be used to request further tickets for other services.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -20,7 +20,7 @@ event krb_as_request%(c: connection, msg: KRB::KDC_Request%);
## contains an encrypted Ticket Granting Ticket (TGT) for that user. ## contains an encrypted Ticket Granting Ticket (TGT) for that user.
## The TGT can then be used to request further tickets for other services. ## The TGT can then be used to request further tickets for other services.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -37,7 +37,7 @@ event krb_as_response%(c: connection, msg: KRB::KDC_Response%);
## authenticate to a Kerberized service, the client requests a Service ## authenticate to a Kerberized service, the client requests a Service
## Ticket, which will be returned in the TGS reply. ## Ticket, which will be returned in the TGS reply.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -53,7 +53,7 @@ event krb_tgs_request%(c: connection, msg: KRB::KDC_Request%);
## which is encrypted with the service's long-term key, and which the ## which is encrypted with the service's long-term key, and which the
## client can use to authenticate to that service. ## client can use to authenticate to that service.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -69,7 +69,7 @@ event krb_tgs_response%(c: connection, msg: KRB::KDC_Response%);
## that should be part of the first message in an authenticated ## that should be part of the first message in an authenticated
## transaction. ## transaction.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -88,7 +88,7 @@ event krb_ap_request%(c: connection, ticket: KRB::Ticket, opts: KRB::AP_Options%
## doesn't have much useful data, but it's provided in case it's important ## doesn't have much useful data, but it's provided in case it's important
## to know that this message was sent. ## to know that this message was sent.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -102,7 +102,7 @@ event krb_ap_response%(c: connection%);
## have much useful data, but it's provided in case it's important to ## have much useful data, but it's provided in case it's important to
## know that this message was sent. ## know that this message was sent.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -116,7 +116,7 @@ event krb_priv%(c: connection, is_orig: bool%);
## A Kerberos 5 ``Safe Message`` as defined in :rfc:`4120`. This is a ## A Kerberos 5 ``Safe Message`` as defined in :rfc:`4120`. This is a
## safe (checksummed) application message. ## safe (checksummed) application message.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -132,7 +132,7 @@ event krb_safe%(c: connection, is_orig: bool, msg: KRB::SAFE_Msg%);
## A Kerberos 5 ``Credential Message`` as defined in :rfc:`4120`. This is ## A Kerberos 5 ``Credential Message`` as defined in :rfc:`4120`. This is
## a private (encrypted) message to forward credentials. ## a private (encrypted) message to forward credentials.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.
@ -147,7 +147,7 @@ event krb_cred%(c: connection, is_orig: bool, tickets: KRB::Ticket_Vector%);
## A Kerberos 5 ``Error Message`` as defined in :rfc:`4120`. ## A Kerberos 5 ``Error Message`` as defined in :rfc:`4120`.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
## more information about the Kerberos protocol. ## more information about the Kerberos protocol.
## ##
## c: The connection over which this Kerberos message was sent. ## c: The connection over which this Kerberos message was sent.

16
src/analyzer/protocol/login/events.bif
View file

@ -245,7 +245,7 @@ event login_display%(c: connection, display: string%);
## option is sent from client to server and the server replies that it accepts ## option is sent from client to server and the server replies that it accepts
## the authentication, then the event engine generates this event. ## the authentication, then the event engine generates this event.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## name: The authenticated name. ## name: The authenticated name.
@ -270,7 +270,7 @@ event authentication_accepted%(name: string, c: connection%);
## is sent from client to server and the server replies that it did not accept ## is sent from client to server and the server replies that it did not accept
## the authentication, then the event engine generates this event. ## the authentication, then the event engine generates this event.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## name: The attempted authentication name. ## name: The attempted authentication name.
@ -293,7 +293,7 @@ event authentication_rejected%(name: string, c: connection%);
## Generated for Telnet/Rlogin sessions when a pattern match indicates ## Generated for Telnet/Rlogin sessions when a pattern match indicates
## that no authentication is performed. ## that no authentication is performed.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## c: The connection. ## c: The connection.
@ -318,7 +318,7 @@ event authentication_skipped%(c: connection%);
## This information is extracted out of environment variables sent as Telnet ## This information is extracted out of environment variables sent as Telnet
## options. ## options.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## c: The connection. ## c: The connection.
@ -339,7 +339,7 @@ event login_prompt%(c: connection, prompt: string%);
## protocol includes options for negotiating encryption. When such a series of ## protocol includes options for negotiating encryption. When such a series of
## options is successfully negotiated, the event engine generates this event. ## options is successfully negotiated, the event engine generates this event.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## c: The connection. ## c: The connection.
@ -357,7 +357,7 @@ event activating_encryption%(c: connection%);
## do, or what it itself offered in terms of options in the past, then the ## do, or what it itself offered in terms of options in the past, then the
## engine generates this event. ## engine generates this event.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## c: The connection. ## c: The connection.
@ -370,7 +370,7 @@ event inconsistent_option%(c: connection%);
## Generated for an ill-formed or unrecognized Telnet option. ## Generated for an ill-formed or unrecognized Telnet option.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## c: The connection. ## c: The connection.
@ -389,7 +389,7 @@ event bad_option%(c: connection%);
## Generated for a Telnet option that's incorrectly terminated. ## Generated for a Telnet option that's incorrectly terminated.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/Telnet>`__ for more information
## about the Telnet protocol. ## about the Telnet protocol.
## ##
## c: The connection. ## c: The connection.

19
src/analyzer/protocol/mime/events.bif
View file

@ -4,7 +4,7 @@
## begins parsing a MIME entity extracted from an email protocol. ## begins parsing a MIME entity extracted from an email protocol.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -23,7 +23,7 @@ event mime_begin_entity%(c: connection%);
## finished parsing a MIME entity extracted from an email protocol. ## finished parsing a MIME entity extracted from an email protocol.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -41,7 +41,7 @@ event mime_end_entity%(c: connection%);
## files, along with corresponding metadata, for transmission. ## files, along with corresponding metadata, for transmission.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -61,7 +61,7 @@ event mime_one_header%(c: connection, h: mime_header_rec%);
## text and files, along with corresponding metadata, for transmission. ## text and files, along with corresponding metadata, for transmission.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -89,7 +89,7 @@ event mime_all_headers%(c: connection, hlist: mime_header_list%);
## the data. Thus, if possible, this event should be preferred. ## the data. Thus, if possible, this event should be preferred.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -115,7 +115,7 @@ event mime_segment_data%(c: connection, length: count, data: string%);
## the latter should be preferred. ## the latter should be preferred.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -138,7 +138,7 @@ event mime_entity_data%(c: connection, length: count, data: string%);
## expensive. ## expensive.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -157,7 +157,7 @@ event mime_all_data%(c: connection, length: count, data: string%);
## Generated for errors found when decoding email MIME entities. ## Generated for errors found when decoding email MIME entities.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -179,7 +179,7 @@ event mime_event%(c: connection, event_type: string, detail: string%);
## each MIME entity. ## each MIME entity.
## ##
## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See ## Zeek's MIME analyzer for emails currently supports SMTP and POP3. See
## `Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information ## `Wikipedia <https://en.wikipedia.org/wiki/MIME>`__ for more information
## about MIME. ## about MIME.
## ##
## c: The connection. ## c: The connection.
@ -194,4 +194,3 @@ event mime_event%(c: connection, event_type: string, detail: string%);
## .. note:: While Zeek also decodes MIME entities extracted from HTTP ## .. note:: While Zeek also decodes MIME entities extracted from HTTP
## sessions, there's no corresponding event for that currently. ## sessions, there's no corresponding event for that currently.
event mime_content_hash%(c: connection, content_len: count, hash_value: string%); event mime_content_hash%(c: connection, content_len: count, hash_value: string%);

4
src/analyzer/protocol/modbus/modbus-analyzer.pac
View file

@ -3,8 +3,8 @@
# the support of the Ministry of Security and Justice of the Kingdom of the # the support of the Ministry of Security and Justice of the Kingdom of the
# Netherlands within the projects of Hermes, Castor and Midas. # Netherlands within the projects of Hermes, Castor and Midas.
# #
# Useful references: http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf # Useful references: https://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf
# http://www.simplymodbus.ca/faq.htm # https://www.simplymodbus.ca/faq.htm
# #
%header{ %header{

4
src/analyzer/protocol/modbus/modbus-protocol.pac
View file

@ -3,8 +3,8 @@
# the support of the Ministry of Security and Justice of the Kingdom of the # the support of the Ministry of Security and Justice of the Kingdom of the
# Netherlands within the projects of Hermes, Castor and Midas. # Netherlands within the projects of Hermes, Castor and Midas.
# #
# Useful references: http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf # Useful references: https://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf
# http://www.simplymodbus.ca/faq.htm # https://www.simplymodbus.ca/faq.htm
enum function_codes { enum function_codes {
# Standard functions # Standard functions

4
src/analyzer/protocol/modbus/modbus.pac
View file

@ -3,8 +3,8 @@
# the support of the Ministry of Security and Justice of the Kingdom of the # the support of the Ministry of Security and Justice of the Kingdom of the
# Netherlands within the projects of Hermes, Castor and Midas. # Netherlands within the projects of Hermes, Castor and Midas.
# #
# Useful references: http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf # Useful references: https://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf
# http://www.simplymodbus.ca/faq.htm # https://www.simplymodbus.ca/faq.htm
%include binpac.pac %include binpac.pac
%include zeek.pac %include zeek.pac

18
src/analyzer/protocol/mysql/events.bif
View file

@ -1,6 +1,6 @@
## Generated for a command request from a MySQL client. ## Generated for a command request from a MySQL client.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -14,7 +14,7 @@ event mysql_command_request%(c: connection, command: count, arg: string%);
## Generated for a change user command from a MySQL client. ## Generated for a change user command from a MySQL client.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -26,7 +26,7 @@ event mysql_change_user%(c: connection, username: string%);
## Generated for an unsuccessful MySQL response. ## Generated for an unsuccessful MySQL response.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -40,7 +40,7 @@ event mysql_error%(c: connection, code: count, msg: string%);
## Generated for a successful MySQL response. ## Generated for a successful MySQL response.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -52,7 +52,7 @@ event mysql_ok%(c: connection, affected_rows: count%);
## Generated for a MySQL EOF packet. ## Generated for a MySQL EOF packet.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -64,7 +64,7 @@ event mysql_eof%(c: connection, is_intermediate: bool%);
## Generated for each MySQL ResultsetRow response packet. ## Generated for each MySQL ResultsetRow response packet.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -76,7 +76,7 @@ event mysql_result_row%(c: connection, row: string_vec%);
## Generated for the initial server handshake packet, which includes the MySQL server version. ## Generated for the initial server handshake packet, which includes the MySQL server version.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -89,7 +89,7 @@ event mysql_server_version%(c: connection, ver: string%);
## Generated for a client handshake response packet, which includes the username the client is attempting ## Generated for a client handshake response packet, which includes the username the client is attempting
## to connect as. ## to connect as.
## ##
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.
@ -102,7 +102,7 @@ event mysql_handshake%(c: connection, username: string%);
## Generated for a short client handshake response packet with the CLIENT_SSL ## Generated for a short client handshake response packet with the CLIENT_SSL
## flag set. Usually the client will initiate a TLS handshake afterwards. ## flag set. Usually the client will initiate a TLS handshake afterwards.
# #
## See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__ ## See the MySQL `documentation <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
## for more information about the MySQL protocol. ## for more information about the MySQL protocol.
## ##
## c: The connection. ## c: The connection.

2
src/analyzer/protocol/mysql/mysql-protocol.pac
View file

@ -1,7 +1,7 @@
# See the file "COPYING" in the main distribution directory for copyright. # See the file "COPYING" in the main distribution directory for copyright.
# #
# All information is from the MySQL internals documentation at: # All information is from the MySQL internals documentation at:
# <http://dev.mysql.com/doc/internals/en/client-server-protocol.html> # <https://dev.mysql.com/doc/internals/en/client-server-protocol.html>
# #
# Basic Types # Basic Types

5
src/analyzer/protocol/ncp/events.bif
View file

@ -1,6 +1,6 @@
## Generated for NCP requests (Netware Core Protocol). ## Generated for NCP requests (Netware Core Protocol).
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for
## more information about the NCP protocol. ## more information about the NCP protocol.
## ##
## c: The connection. ## c: The connection.
@ -21,7 +21,7 @@ event ncp_request%(c: connection, frame_type: count, length: count, func: count%
## Generated for NCP replies (Netware Core Protocol). ## Generated for NCP replies (Netware Core Protocol).
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for
## more information about the NCP protocol. ## more information about the NCP protocol.
## ##
## c: The connection. ## c: The connection.
@ -43,4 +43,3 @@ event ncp_request%(c: connection, frame_type: count, length: count, func: count%
## been ported. To still enable this event, one needs to ## been ported. To still enable this event, one needs to
## register a port for it or add a DPD payload signature. ## register a port for it or add a DPD payload signature.
event ncp_reply%(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count%); event ncp_reply%(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count%);

29
src/analyzer/protocol/netbios/events.bif
View file

@ -2,7 +2,7 @@
## processes the NetBIOS session service running on TCP port 139, and (despite ## processes the NetBIOS session service running on TCP port 139, and (despite
## its name!) the NetBIOS datagram service on UDP port 138. ## its name!) the NetBIOS datagram service on UDP port 138.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/NetBIOS>`__ for more information
## about NetBIOS. :rfc:`1002` describes ## about NetBIOS. :rfc:`1002` describes
## the packet format for NetBIOS over TCP/IP, which Zeek parses. ## the packet format for NetBIOS over TCP/IP, which Zeek parses.
## ##
@ -21,7 +21,7 @@
## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type ## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
## ##
## .. note:: These days, NetBIOS is primarily used as a transport mechanism for ## .. note:: These days, NetBIOS is primarily used as a transport mechanism for
## `SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's ## `SMB/CIFS <https://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's
## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445. ## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
## ##
## .. todo:: Zeek's current default configuration does not activate the protocol ## .. todo:: Zeek's current default configuration does not activate the protocol
@ -34,7 +34,7 @@ event netbios_session_message%(c: connection, is_orig: bool, msg_type: count, da
## analyzer processes the NetBIOS session service running on TCP port 139, and ## analyzer processes the NetBIOS session service running on TCP port 139, and
## (despite its name!) the NetBIOS datagram service on UDP port 138. ## (despite its name!) the NetBIOS datagram service on UDP port 138.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/NetBIOS>`__ for more information
## about NetBIOS. :rfc:`1002` describes ## about NetBIOS. :rfc:`1002` describes
## the packet format for NetBIOS over TCP/IP, which Zeek parses. ## the packet format for NetBIOS over TCP/IP, which Zeek parses.
## ##
@ -49,7 +49,7 @@ event netbios_session_message%(c: connection, is_orig: bool, msg_type: count, da
## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type ## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
## ##
## .. note:: These days, NetBIOS is primarily used as a transport mechanism for ## .. note:: These days, NetBIOS is primarily used as a transport mechanism for
## `SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's ## `SMB/CIFS <https://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's
## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445. ## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
## ##
## .. todo:: Zeek's current default configuration does not activate the protocol ## .. todo:: Zeek's current default configuration does not activate the protocol
@ -62,7 +62,7 @@ event netbios_session_request%(c: connection, msg: string%);
## NetBIOS analyzer processes the NetBIOS session service running on TCP port ## NetBIOS analyzer processes the NetBIOS session service running on TCP port
## 139, and (despite its name!) the NetBIOS datagram service on UDP port 138. ## 139, and (despite its name!) the NetBIOS datagram service on UDP port 138.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/NetBIOS>`__ for more information
## about NetBIOS. :rfc:`1002` describes ## about NetBIOS. :rfc:`1002` describes
## the packet format for NetBIOS over TCP/IP, which Zeek parses. ## the packet format for NetBIOS over TCP/IP, which Zeek parses.
## ##
@ -77,7 +77,7 @@ event netbios_session_request%(c: connection, msg: string%);
## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type ## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
## ##
## .. note:: These days, NetBIOS is primarily used as a transport mechanism for ## .. note:: These days, NetBIOS is primarily used as a transport mechanism for
## `SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's ## `SMB/CIFS <https://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's
## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445. ## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
## ##
## .. todo:: Zeek's current default configuration does not activate the protocol ## .. todo:: Zeek's current default configuration does not activate the protocol
@ -90,7 +90,7 @@ event netbios_session_accepted%(c: connection, msg: string%);
## NetBIOS analyzer processes the NetBIOS session service running on TCP port ## NetBIOS analyzer processes the NetBIOS session service running on TCP port
## 139, and (despite its name!) the NetBIOS datagram service on UDP port 138. ## 139, and (despite its name!) the NetBIOS datagram service on UDP port 138.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/NetBIOS>`__ for more information
## about NetBIOS. :rfc:`1002` describes ## about NetBIOS. :rfc:`1002` describes
## the packet format for NetBIOS over TCP/IP, which Zeek parses. ## the packet format for NetBIOS over TCP/IP, which Zeek parses.
## ##
@ -105,7 +105,7 @@ event netbios_session_accepted%(c: connection, msg: string%);
## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type ## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
## ##
## .. note:: These days, NetBIOS is primarily used as a transport mechanism for ## .. note:: These days, NetBIOS is primarily used as a transport mechanism for
## `SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's ## `SMB/CIFS <https://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's
## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445. ## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
## ##
## .. todo:: Zeek's current default configuration does not activate the protocol ## .. todo:: Zeek's current default configuration does not activate the protocol
@ -120,7 +120,7 @@ event netbios_session_rejected%(c: connection, msg: string%);
## NetBIOS analyzer processes the NetBIOS session service running on TCP port ## NetBIOS analyzer processes the NetBIOS session service running on TCP port
## 139, and (despite its name!) the NetBIOS datagram service on UDP port 138. ## 139, and (despite its name!) the NetBIOS datagram service on UDP port 138.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/NetBIOS>`__ for more information
## about NetBIOS. :rfc:`1002` describes ## about NetBIOS. :rfc:`1002` describes
## the packet format for NetBIOS over TCP/IP, which Zeek parses. ## the packet format for NetBIOS over TCP/IP, which Zeek parses.
## ##
@ -137,7 +137,7 @@ event netbios_session_rejected%(c: connection, msg: string%);
## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type ## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
## ##
## .. note:: These days, NetBIOS is primarily used as a transport mechanism for ## .. note:: These days, NetBIOS is primarily used as a transport mechanism for
## `SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's ## `SMB/CIFS <https://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's
## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445. ## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
## ##
## .. todo:: This is an oddly named event. In fact, it's probably an odd event ## .. todo:: This is an oddly named event. In fact, it's probably an odd event
@ -153,7 +153,7 @@ event netbios_session_raw_message%(c: connection, is_orig: bool, msg: string%);
## analyzer processes the NetBIOS session service running on TCP port 139, and ## analyzer processes the NetBIOS session service running on TCP port 139, and
## (despite its name!) the NetBIOS datagram service on UDP port 138. ## (despite its name!) the NetBIOS datagram service on UDP port 138.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/NetBIOS>`__ for more information
## about NetBIOS. :rfc:`1002` describes ## about NetBIOS. :rfc:`1002` describes
## the packet format for NetBIOS over TCP/IP, which Zeek parses. ## the packet format for NetBIOS over TCP/IP, which Zeek parses.
## ##
@ -168,7 +168,7 @@ event netbios_session_raw_message%(c: connection, is_orig: bool, msg: string%);
## netbios_session_request decode_netbios_name decode_netbios_name_type ## netbios_session_request decode_netbios_name decode_netbios_name_type
## ##
## .. note:: These days, NetBIOS is primarily used as a transport mechanism for ## .. note:: These days, NetBIOS is primarily used as a transport mechanism for
## `SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's ## `SMB/CIFS <https://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's
## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445. ## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
## ##
## .. todo:: This is an oddly named event. ## .. todo:: This is an oddly named event.
@ -183,7 +183,7 @@ event netbios_session_ret_arg_resp%(c: connection, msg: string%);
## processes the NetBIOS session service running on TCP port 139, and (despite ## processes the NetBIOS session service running on TCP port 139, and (despite
## its name!) the NetBIOS datagram service on UDP port 138. ## its name!) the NetBIOS datagram service on UDP port 138.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/NetBIOS>`__ for more information
## about NetBIOS. :rfc:`1002` describes ## about NetBIOS. :rfc:`1002` describes
## the packet format for NetBIOS over TCP/IP, which Zeek parses. ## the packet format for NetBIOS over TCP/IP, which Zeek parses.
## ##
@ -198,7 +198,7 @@ event netbios_session_ret_arg_resp%(c: connection, msg: string%);
## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type ## netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
## ##
## .. note:: These days, NetBIOS is primarily used as a transport mechanism for ## .. note:: These days, NetBIOS is primarily used as a transport mechanism for
## `SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's ## `SMB/CIFS <https://en.wikipedia.org/wiki/Server_Message_Block>`__. Zeek's
## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445. ## SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
## ##
## .. todo:: Zeek's current default configuration does not activate the protocol ## .. todo:: Zeek's current default configuration does not activate the protocol
@ -206,4 +206,3 @@ event netbios_session_ret_arg_resp%(c: connection, msg: string%);
## been ported. To still enable this event, one needs to ## been ported. To still enable this event, one needs to
## register a port for it or add a DPD payload signature. ## register a port for it or add a DPD payload signature.
event netbios_session_keepalive%(c: connection, msg: string%); event netbios_session_keepalive%(c: connection, msg: string%);

2
src/analyzer/protocol/ntp/events.bif
View file

@ -1,7 +1,7 @@
## Generated for all NTP messages. Different from many other of Zeek's events, ## Generated for all NTP messages. Different from many other of Zeek's events,
## this one is generated for both client-side and server-side messages. ## this one is generated for both client-side and server-side messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Network_Time_Protocol>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Network_Time_Protocol>`__ for
## more information about the NTP protocol. ## more information about the NTP protocol.
## ##
## c: The connection record describing the corresponding UDP flow. ## c: The connection record describing the corresponding UDP flow.

15
src/analyzer/protocol/pop3/events.bif
View file

@ -1,6 +1,6 @@
## Generated for client-side commands on POP3 connections. ## Generated for client-side commands on POP3 connections.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/POP3>`__ for more information
## about the POP3 protocol. ## about the POP3 protocol.
## ##
## c: The connection. ## c: The connection.
@ -24,7 +24,7 @@ event pop3_request%(c: connection, is_orig: bool,
## Generated for server-side replies to commands on POP3 connections. ## Generated for server-side replies to commands on POP3 connections.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/POP3>`__ for more information
## about the POP3 protocol. ## about the POP3 protocol.
## ##
## c: The connection. ## c: The connection.
@ -53,7 +53,7 @@ event pop3_reply%(c: connection, is_orig: bool, cmd: string, msg: string%);
## mails. This event is generated once for each line that's part of such a ## mails. This event is generated once for each line that's part of such a
## response. ## response.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/POP3>`__ for more information
## about the POP3 protocol. ## about the POP3 protocol.
## ##
## c: The connection. ## c: The connection.
@ -75,7 +75,7 @@ event pop3_data%(c: connection, is_orig: bool, data: string%);
## finds state transitions that do not conform to the protocol specification, ## finds state transitions that do not conform to the protocol specification,
## or other situations it can't handle, it raises this event. ## or other situations it can't handle, it raises this event.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/POP3>`__ for more information
## about the POP3 protocol. ## about the POP3 protocol.
## ##
## c: The connection. ## c: The connection.
@ -100,7 +100,7 @@ event pop3_unexpected%(c: connection, is_orig: bool,
## generated if that happens and the analyzer then stops processing the ## generated if that happens and the analyzer then stops processing the
## connection. ## connection.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/POP3>`__ for more information
## about the POP3 protocol. ## about the POP3 protocol.
## ##
## c: The connection. ## c: The connection.
@ -116,7 +116,7 @@ event pop3_starttls%(c: connection%);
## Generated for successful authentications on POP3 connections. ## Generated for successful authentications on POP3 connections.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/POP3>`__ for more information
## about the POP3 protocol. ## about the POP3 protocol.
## ##
## c: The connection. ## c: The connection.
@ -140,7 +140,7 @@ event pop3_login_success%(c: connection, is_orig: bool,
## Generated for unsuccessful authentications on POP3 connections. ## Generated for unsuccessful authentications on POP3 connections.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/POP3>`__ for more information
## about the POP3 protocol. ## about the POP3 protocol.
## ##
## c: The connection. ## c: The connection.
@ -161,4 +161,3 @@ event pop3_login_success%(c: connection, is_orig: bool,
## register a port for it or add a DPD payload signature. ## register a port for it or add a DPD payload signature.
event pop3_login_failure%(c: connection, is_orig: bool, event pop3_login_failure%(c: connection, is_orig: bool,
user: string, password: string%); user: string, password: string%);

4
src/analyzer/protocol/radius/events.bif
View file

@ -1,6 +1,6 @@
## Generated for RADIUS messages. ## Generated for RADIUS messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/RADIUS>`__ for more
## information about RADIUS. ## information about RADIUS.
## ##
## c: The connection. ## c: The connection.
@ -11,7 +11,7 @@ event radius_message%(c: connection, result: RADIUS::Message%);
## Generated for each RADIUS attribute. ## Generated for each RADIUS attribute.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/RADIUS>`__ for more
## information about RADIUS. ## information about RADIUS.
## ##
## c: The connection. ## c: The connection.

64
src/analyzer/protocol/rpc/events.bif
View file

@ -3,7 +3,7 @@
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -26,7 +26,7 @@ event nfs_proc_null%(c: connection, info: NFS3::info_t%);
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -54,7 +54,7 @@ event nfs_proc_getattr%(c: connection, info: NFS3::info_t, fh: string, attrs: NF
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -82,7 +82,7 @@ event nfs_proc_sattr%(c: connection, info: NFS3::info_t, req: NFS3::sattrargs_t,
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -110,7 +110,7 @@ event nfs_proc_lookup%(c: connection, info: NFS3::info_t, req: NFS3::diropargs_t
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -138,7 +138,7 @@ event nfs_proc_read%(c: connection, info: NFS3::info_t, req: NFS3::readargs_t, r
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -166,7 +166,7 @@ event nfs_proc_readlink%(c: connection, info: NFS3::info_t, fh: string, rep: NFS
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -194,7 +194,7 @@ event nfs_proc_symlink%(c: connection, info: NFS3::info_t, req: NFS3::symlinkarg
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -222,7 +222,7 @@ event nfs_proc_link%(c: connection, info: NFS3::info_t, req: NFS3::linkargs_t, r
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -251,7 +251,7 @@ event nfs_proc_write%(c: connection, info: NFS3::info_t, req: NFS3::writeargs_t,
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -279,7 +279,7 @@ event nfs_proc_create%(c: connection, info: NFS3::info_t, req: NFS3::diropargs_t
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -307,7 +307,7 @@ event nfs_proc_mkdir%(c: connection, info: NFS3::info_t, req: NFS3::diropargs_t,
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -335,7 +335,7 @@ event nfs_proc_remove%(c: connection, info: NFS3::info_t, req: NFS3::diropargs_t
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -363,7 +363,7 @@ event nfs_proc_rmdir%(c: connection, info: NFS3::info_t, req: NFS3::diropargs_t,
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -391,7 +391,7 @@ event nfs_proc_rename%(c: connection, info: NFS3::info_t, req: NFS3::renameoparg
## reply, or an unanswered request has timed out. ## reply, or an unanswered request has timed out.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -418,7 +418,7 @@ event nfs_proc_readdir%(c: connection, info: NFS3::info_t, req: NFS3::readdirarg
## analyzer does not implement. ## analyzer does not implement.
## ##
## NFS is a service running on top of RPC. See `Wikipedia ## NFS is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more ## <https://en.wikipedia.org/wiki/Network_File_System_(protocol)>`__ for more
## information about the service. ## information about the service.
## ##
## c: The RPC connection. ## c: The RPC connection.
@ -458,7 +458,7 @@ event nfs_reply_status%(n: connection, info: NFS3::info_t%);
## Generated for Portmapper requests of type *null*. ## Generated for Portmapper requests of type *null*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -477,7 +477,7 @@ event pm_request_null%(r: connection%);
## Generated for Portmapper request/reply dialogues of type *set*. ## Generated for Portmapper request/reply dialogues of type *set*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -502,7 +502,7 @@ event pm_request_set%(r: connection, m: pm_mapping, success: bool%);
## Generated for Portmapper request/reply dialogues of type *unset*. ## Generated for Portmapper request/reply dialogues of type *unset*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -527,7 +527,7 @@ event pm_request_unset%(r: connection, m: pm_mapping, success: bool%);
## Generated for Portmapper request/reply dialogues of type *getport*. ## Generated for Portmapper request/reply dialogues of type *getport*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -550,7 +550,7 @@ event pm_request_getport%(r: connection, pr: pm_port_request, p: port%);
## Generated for Portmapper request/reply dialogues of type *dump*. ## Generated for Portmapper request/reply dialogues of type *dump*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -572,7 +572,7 @@ event pm_request_dump%(r: connection, m: pm_mappings%);
## Generated for Portmapper request/reply dialogues of type *callit*. ## Generated for Portmapper request/reply dialogues of type *callit*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -596,7 +596,7 @@ event pm_request_callit%(r: connection, call: pm_callit_request, p: port%);
## Generated for failed Portmapper requests of type *null*. ## Generated for failed Portmapper requests of type *null*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -619,7 +619,7 @@ event pm_attempt_null%(r: connection, status: rpc_status%);
## Generated for failed Portmapper requests of type *set*. ## Generated for failed Portmapper requests of type *set*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -644,7 +644,7 @@ event pm_attempt_set%(r: connection, status: rpc_status, m: pm_mapping%);
## Generated for failed Portmapper requests of type *unset*. ## Generated for failed Portmapper requests of type *unset*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -669,7 +669,7 @@ event pm_attempt_unset%(r: connection, status: rpc_status, m: pm_mapping%);
## Generated for failed Portmapper requests of type *getport*. ## Generated for failed Portmapper requests of type *getport*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -693,7 +693,7 @@ event pm_attempt_getport%(r: connection, status: rpc_status, pr: pm_port_request
## Generated for failed Portmapper requests of type *dump*. ## Generated for failed Portmapper requests of type *dump*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -716,7 +716,7 @@ event pm_attempt_dump%(r: connection, status: rpc_status%);
## Generated for failed Portmapper requests of type *callit*. ## Generated for failed Portmapper requests of type *callit*.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -744,7 +744,7 @@ event pm_attempt_callit%(r: connection, status: rpc_status, call: pm_callit_requ
## event is generated. ## event is generated.
## ##
## Portmapper is a service running on top of RPC. See `Wikipedia ## Portmapper is a service running on top of RPC. See `Wikipedia
## <http://en.wikipedia.org/wiki/Portmap>`__ for more information about the ## <https://en.wikipedia.org/wiki/Portmap>`__ for more information about the
## service. ## service.
## ##
## r: The RPC connection. ## r: The RPC connection.
@ -769,7 +769,7 @@ event pm_bad_port%(r: connection, bad_p: count%);
## eventually on timeout. In that case, *status* will be set to ## eventually on timeout. In that case, *status* will be set to
## :zeek:enum:`RPC_TIMEOUT`. ## :zeek:enum:`RPC_TIMEOUT`.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/ONC_RPC>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/ONC_RPC>`__ for more information
## about the ONC RPC protocol. ## about the ONC RPC protocol.
## ##
## c: The connection. ## c: The connection.
@ -801,7 +801,7 @@ event rpc_dialogue%(c: connection, prog: count, ver: count, proc: count, status:
## Generated for RPC *call* messages. ## Generated for RPC *call* messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/ONC_RPC>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/ONC_RPC>`__ for more information
## about the ONC RPC protocol. ## about the ONC RPC protocol.
## ##
## c: The connection. ## c: The connection.
@ -828,7 +828,7 @@ event rpc_call%(c: connection, xid: count, prog: count, ver: count, proc: count,
## Generated for RPC *reply* messages. ## Generated for RPC *reply* messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/ONC_RPC>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/ONC_RPC>`__ for more information
## about the ONC RPC protocol. ## about the ONC RPC protocol.
## ##
## c: The connection. ## c: The connection.

12
src/analyzer/protocol/sip/events.bif
View file

@ -2,7 +2,7 @@
## ##
## This event is generated as soon as a request's initial line has been parsed. ## This event is generated as soon as a request's initial line has been parsed.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol. ## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
## ##
## c: The connection. ## c: The connection.
@ -20,7 +20,7 @@ event sip_request%(c: connection, method: string, original_URI: string, version:
## ##
## This event is generated as soon as a reply's initial line has been parsed. ## This event is generated as soon as a reply's initial line has been parsed.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol. ## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
## ##
## c: The connection. ## c: The connection.
@ -36,7 +36,7 @@ event sip_reply%(c: connection, version: string, code: count, reason: string%);
## Generated for each :abbr:`SIP (Session Initiation Protocol)` header. ## Generated for each :abbr:`SIP (Session Initiation Protocol)` header.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol. ## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
## ##
## c: The connection. ## c: The connection.
@ -52,7 +52,7 @@ event sip_header%(c: connection, is_orig: bool, name: string, value: string%);
## Generated once for all :abbr:`SIP (Session Initiation Protocol)` headers from the originator or responder. ## Generated once for all :abbr:`SIP (Session Initiation Protocol)` headers from the originator or responder.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol. ## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
## ##
## c: The connection. ## c: The connection.
@ -68,7 +68,7 @@ event sip_all_headers%(c: connection, is_orig: bool, hlist: mime_header_list%);
## ##
## This event is generated as soon as a message's initial line has been parsed. ## This event is generated as soon as a message's initial line has been parsed.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol. ## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
## ##
## c: The connection. ## c: The connection.
@ -80,7 +80,7 @@ event sip_begin_entity%(c: connection, is_orig: bool%);
## Generated at the end of a :abbr:`SIP (Session Initiation Protocol)` message. ## Generated at the end of a :abbr:`SIP (Session Initiation Protocol)` message.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol. ## for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
## ##
## c: The connection. ## c: The connection.

4
src/analyzer/protocol/smb/smb1-com-echo.pac
View file

@ -19,7 +19,7 @@ refine connection SMB_Conn += {
}; };
# http://msdn.microsoft.com/en-us/library/ee441746.aspx # https://msdn.microsoft.com/en-us/library/ee441746.aspx
type SMB1_echo_request(header: SMB_Header) = record { type SMB1_echo_request(header: SMB_Header) = record {
word_count : uint8; word_count : uint8;
echo_count : uint16; echo_count : uint16;
@ -30,7 +30,7 @@ type SMB1_echo_request(header: SMB_Header) = record {
proc : bool = $context.connection.proc_smb1_echo_request(header, this); proc : bool = $context.connection.proc_smb1_echo_request(header, this);
}; };
# http://msdn.microsoft.com/en-us/library/ee441626.aspx # https://msdn.microsoft.com/en-us/library/ee441626.aspx
type SMB1_echo_response(header: SMB_Header) = record { type SMB1_echo_response(header: SMB_Header) = record {
word_count : uint8; word_count : uint8;
seq_num : uint16; seq_num : uint16;

4
src/analyzer/protocol/smb/smb1-com-locking-andx.pac
View file

@ -27,7 +27,7 @@ type LOCKING_ANDX_RANGE64 = record {
byte_len : uint64; byte_len : uint64;
}; };
# http://msdn.microsoft.com/en-us/library/ee442004.aspx # https://msdn.microsoft.com/en-us/library/ee442004.aspx
type SMB1_locking_andx_request(header: SMB_Header, offset: uint16) = record { type SMB1_locking_andx_request(header: SMB_Header, offset: uint16) = record {
word_count : uint8; word_count : uint8;
andx : SMB_andx; andx : SMB_andx;
@ -55,7 +55,7 @@ type SMB1_locking_andx_request(header: SMB_Header, offset: uint16) = record {
proc : bool = $context.connection.proc_smb1_locking_andx_request(header, this); proc : bool = $context.connection.proc_smb1_locking_andx_request(header, this);
}; };
# http://msdn.microsoft.com/en-us/library/ee441519.aspx # https://msdn.microsoft.com/en-us/library/ee441519.aspx
type SMB1_locking_andx_response(header: SMB_Header) = record { type SMB1_locking_andx_response(header: SMB_Header) = record {
} &let { } &let {
proc : bool = $context.connection.proc_smb1_locking_andx_response(header, this); proc : bool = $context.connection.proc_smb1_locking_andx_response(header, this);

4
src/analyzer/protocol/smb/smb1-com-nt-transact.pac
View file

@ -14,14 +14,14 @@ refine connection SMB_Conn += {
}; };
# http://msdn.microsoft.com/en-us/library/ee441534.aspx # https://msdn.microsoft.com/en-us/library/ee441534.aspx
type SMB1_nt_transact_request(header: SMB_Header) = record { type SMB1_nt_transact_request(header: SMB_Header) = record {
word_count : uint8; word_count : uint8;
} &let { } &let {
proc : bool = $context.connection.proc_smb1_nt_transact_request(header, this); proc : bool = $context.connection.proc_smb1_nt_transact_request(header, this);
}; };
# http://msdn.microsoft.com/en-us/library/ee442112.aspx # https://msdn.microsoft.com/en-us/library/ee442112.aspx
type SMB1_nt_transact_response(header: SMB_Header) = record { type SMB1_nt_transact_response(header: SMB_Header) = record {
word_count : uint8; word_count : uint8;
} &let { } &let {

3
src/analyzer/protocol/smb/smb1_events.bif
View file

@ -1,7 +1,7 @@
## Generated for all :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` version 1 ## Generated for all :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` version 1
## messages. ## messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Server_Message_Block>`__ for more information about the ## See `Wikipedia <https://en.wikipedia.org/wiki/Server_Message_Block>`__ for more information about the
## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` protocol. Zeek's ## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` protocol. Zeek's
## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` analyzer parses ## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` analyzer parses
## both :abbr:`SMB (Server Message Block)`-over-:abbr:`NetBIOS (Network Basic Input/Output System)` on ## both :abbr:`SMB (Server Message Block)`-over-:abbr:`NetBIOS (Network Basic Input/Output System)` on
@ -39,4 +39,3 @@ event smb1_empty_response%(c: connection, hdr: SMB1::Header%);
## ##
## .. zeek:see:: smb1_message ## .. zeek:see:: smb1_message
event smb1_error%(c: connection, hdr: SMB1::Header, is_orig: bool%); event smb1_error%(c: connection, hdr: SMB1::Header, is_orig: bool%);

2
src/analyzer/protocol/smb/smb2-protocol.pac
View file

@ -1,5 +1,5 @@
# Documentation for SMB2 protocol from here: # Documentation for SMB2 protocol from here:
# http://msdn.microsoft.com/en-us/library/cc246497(v=PROT.13).aspx # https://msdn.microsoft.com/en-us/library/cc246497(v=PROT.13).aspx
%header{ %header{
zeek::RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr); zeek::RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr);

2
src/analyzer/protocol/smb/smb2_events.bif
View file

@ -1,7 +1,7 @@
## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` ## Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
## version 2 messages. ## version 2 messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Server_Message_Block>`__ for more information about the ## See `Wikipedia <https://en.wikipedia.org/wiki/Server_Message_Block>`__ for more information about the
## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` protocol. Zeek's ## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` protocol. Zeek's
## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` analyzer parses ## :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` analyzer parses
## both :abbr:`SMB (Server Message Block)`-over-:abbr:`NetBIOS (Network Basic Input/Output System)` on ## both :abbr:`SMB (Server Message Block)`-over-:abbr:`NetBIOS (Network Basic Input/Output System)` on

8
src/analyzer/protocol/smtp/events.bif
View file

@ -1,6 +1,6 @@
## Generated for client-side SMTP commands. ## Generated for client-side SMTP commands.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
## for more information about the SMTP protocol. ## for more information about the SMTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -25,7 +25,7 @@ event smtp_request%(c: connection, is_orig: bool, command: string, arg: string%)
## Generated for server-side SMTP commands. ## Generated for server-side SMTP commands.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
## for more information about the SMTP protocol. ## for more information about the SMTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -59,7 +59,7 @@ event smtp_reply%(c: connection, is_orig: bool, code: count, cmd: string, msg: s
## corresponding end marker ``.`` is seen. A handler may want to reassemble ## corresponding end marker ``.`` is seen. A handler may want to reassemble
## the pieces as they come in if stream-analysis is required. ## the pieces as they come in if stream-analysis is required.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
## for more information about the SMTP protocol. ## for more information about the SMTP protocol.
## ##
## c: The connection. ## c: The connection.
@ -84,7 +84,7 @@ event smtp_data%(c: connection, is_orig: bool, data: string%);
## event that it sees even though it would not expect so at the current point ## event that it sees even though it would not expect so at the current point
## of the communication. ## of the communication.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
## for more information about the SMTP protocol. ## for more information about the SMTP protocol.
## ##
## c: The connection. ## c: The connection.

11
src/analyzer/protocol/ssl/events.bif
View file

@ -3,7 +3,7 @@
## of that as it can. This event provides access to the initial information ## of that as it can. This event provides access to the initial information
## sent by the client. ## sent by the client.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for
## more information about the SSL/TLS protocol. ## more information about the SSL/TLS protocol.
## ##
## c: The connection. ## c: The connection.
@ -42,7 +42,7 @@ event ssl_client_hello%(c: connection, version: count, record_version: count, po
## of that as it can. This event provides access to the initial information ## of that as it can. This event provides access to the initial information
## sent by the client. ## sent by the client.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for
## more information about the SSL/TLS protocol. ## more information about the SSL/TLS protocol.
## ##
## c: The connection. ## c: The connection.
@ -499,7 +499,7 @@ event ssl_extension_connection_id%(c: connection, is_client: bool, cid: string%)
## handshake and its endpoints consider it as fully established. Typically, ## handshake and its endpoints consider it as fully established. Typically,
## everything from now on will be encrypted. ## everything from now on will be encrypted.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for
## more information about the SSL/TLS protocol. ## more information about the SSL/TLS protocol.
## ##
## c: The connection. ## c: The connection.
@ -514,7 +514,7 @@ event ssl_established%(c: connection%);
## sends an *alert* record, that in turn triggers this event. After an *alert*, ## sends an *alert* record, that in turn triggers this event. After an *alert*,
## any endpoint may close the connection immediately. ## any endpoint may close the connection immediately.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for
## more information about the SSL/TLS protocol. ## more information about the SSL/TLS protocol.
## ##
## c: The connection. ## c: The connection.
@ -540,7 +540,7 @@ event ssl_alert%(c: connection, is_client: bool, level: count, desc: count%);
## ticket to the client that can later be used for resuming the session. The ## ticket to the client that can later be used for resuming the session. The
## mechanism is described in :rfc:`4507`. ## mechanism is described in :rfc:`4507`.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for ## See `Wikipedia <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__ for
## more information about the SSL/TLS protocol. ## more information about the SSL/TLS protocol.
## ##
## c: The connection. ## c: The connection.
@ -748,4 +748,3 @@ event ssl_connection_flipped%(c: connection%);
## .. zeek:see:: ssl_handshake_message x509_certificate ssl_server_hello ssl_client_hello ## .. zeek:see:: ssl_handshake_message x509_certificate ssl_server_hello ssl_client_hello
## parse_distinguished_name ## parse_distinguished_name
event ssl_certificate_request%(c: connection, is_client: bool, certificate_types: index_vec, supported_signature_algorithms: signature_and_hashalgorithm_vec, certificate_authorities: string_vec%); event ssl_certificate_request%(c: connection, is_client: bool, certificate_types: index_vec, supported_signature_algorithms: signature_and_hashalgorithm_vec, certificate_authorities: string_vec%);

2
src/analyzer/protocol/syslog/legacy/events.bif
View file

@ -1,7 +1,7 @@
## Generated for monitored Syslog messages. ## Generated for monitored Syslog messages.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Syslog>`__ for more ## See `Wikipedia <https://en.wikipedia.org/wiki/Syslog>`__ for more
## information about the Syslog protocol. ## information about the Syslog protocol.
## ##
## c: The connection record for the underlying transport-layer session/flow. ## c: The connection record for the underlying transport-layer session/flow.

4
src/file_analysis/analyzer/x509/events.bif
View file

@ -1,7 +1,7 @@
## Generated for encountered X509 certificates, e.g., in the clear SSL/TLS ## Generated for encountered X509 certificates, e.g., in the clear SSL/TLS
## connection handshake. ## connection handshake.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/X.509>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/X.509>`__ for more information
## about the X.509 format. ## about the X.509 format.
## ##
## f: The file. ## f: The file.
@ -18,7 +18,7 @@ event x509_certificate%(f: fa_file, cert_ref: opaque of x509, cert: X509::Certif
## Generated for X509 extensions seen in a certificate. ## Generated for X509 extensions seen in a certificate.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/X.509>`__ for more information ## See `Wikipedia <https://en.wikipedia.org/wiki/X.509>`__ for more information
## about the X.509 format. ## about the X.509 format.
## ##
## f: The file. ## f: The file.

4
src/packet_analysis/protocol/arp/events.bif
View file

@ -1,6 +1,6 @@
## Generated for ARP requests. ## Generated for ARP requests.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Address_Resolution_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Address_Resolution_Protocol>`__
## for more information about the ARP protocol. ## for more information about the ARP protocol.
## ##
## mac_src: The request's source MAC address. ## mac_src: The request's source MAC address.
@ -21,7 +21,7 @@ event arp_request%(mac_src: string, mac_dst: string, SPA: addr, SHA: string,
## Generated for ARP replies. ## Generated for ARP replies.
## ##
## See `Wikipedia <http://en.wikipedia.org/wiki/Address_Resolution_Protocol>`__ ## See `Wikipedia <https://en.wikipedia.org/wiki/Address_Resolution_Protocol>`__
## for more information about the ARP protocol. ## for more information about the ARP protocol.
## ##
## mac_src: The reply's source MAC address. ## mac_src: The reply's source MAC address.

26
src/packet_analysis/protocol/icmp/events.bif
View file

@ -4,7 +4,7 @@
## doesn't. ## doesn't.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -36,7 +36,7 @@ event icmp_sent_payload%(c: connection, info: icmp_info, payload: string%);
## Generated for ICMP *echo request* messages. ## Generated for ICMP *echo request* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -60,7 +60,7 @@ event icmp_echo_request%(c: connection, info: icmp_info, id: count, seq: count,
## Generated for ICMP *echo reply* messages. ## Generated for ICMP *echo reply* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -87,7 +87,7 @@ event icmp_echo_reply%(c: connection, info: icmp_info, id: count, seq: count, pa
## as a fallback for those it doesn't. ## as a fallback for those it doesn't.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/ICMPv6>`__ for more ## <https://en.wikipedia.org/wiki/ICMPv6>`__ for more
## information about the ICMPv6 protocol. ## information about the ICMPv6 protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -110,7 +110,7 @@ event icmp_error_message%(c: connection, info: icmp_info, code: count, context:
## Generated for ICMP *destination unreachable* messages. ## Generated for ICMP *destination unreachable* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -137,7 +137,7 @@ event icmp_unreachable%(c: connection, info: icmp_info, code: count, context: ic
## Generated for ICMPv6 *packet too big* messages. ## Generated for ICMPv6 *packet too big* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/ICMPv6>`__ for more ## <https://en.wikipedia.org/wiki/ICMPv6>`__ for more
## information about the ICMPv6 protocol. ## information about the ICMPv6 protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -164,7 +164,7 @@ event icmp_packet_too_big%(c: connection, info: icmp_info, code: count, context:
## Generated for ICMP *time exceeded* messages. ## Generated for ICMP *time exceeded* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -191,7 +191,7 @@ event icmp_time_exceeded%(c: connection, info: icmp_info, code: count, context:
## Generated for ICMPv6 *parameter problem* messages. ## Generated for ICMPv6 *parameter problem* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/ICMPv6>`__ for more ## <https://en.wikipedia.org/wiki/ICMPv6>`__ for more
## information about the ICMPv6 protocol. ## information about the ICMPv6 protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -218,7 +218,7 @@ event icmp_parameter_problem%(c: connection, info: icmp_info, code: count, conte
## Generated for ICMP *router solicitation* messages. ## Generated for ICMP *router solicitation* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -238,7 +238,7 @@ event icmp_router_solicitation%(c: connection, info: icmp_info, options: icmp6_n
## Generated for ICMP *router advertisement* messages. ## Generated for ICMP *router advertisement* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -279,7 +279,7 @@ event icmp_router_advertisement%(c: connection, info: icmp_info, cur_hop_limit:
## Generated for ICMP *neighbor solicitation* messages. ## Generated for ICMP *neighbor solicitation* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -301,7 +301,7 @@ event icmp_neighbor_solicitation%(c: connection, info: icmp_info, tgt: addr, opt
## Generated for ICMP *neighbor advertisement* messages. ## Generated for ICMP *neighbor advertisement* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.
@ -330,7 +330,7 @@ event icmp_neighbor_advertisement%(c: connection, info: icmp_info, router: bool,
## Generated for ICMP *redirect* messages. ## Generated for ICMP *redirect* messages.
## ##
## See `Wikipedia ## See `Wikipedia
## <http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more ## <https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
## information about the ICMP protocol. ## information about the ICMP protocol.
## ##
## c: The connection record for the corresponding ICMP flow. ## c: The connection record for the corresponding ICMP flow.

4
src/strings.bif
View file

@ -13,7 +13,7 @@ using namespace std;
%%} %%}
## Calculates the Levenshtein distance between the two strings. See `Wikipedia ## Calculates the Levenshtein distance between the two strings. See `Wikipedia
## <http://en.wikipedia.org/wiki/Levenshtein_distance>`__ for more information. ## <https://en.wikipedia.org/wiki/Levenshtein_distance>`__ for more information.
## ##
## s1: The first string. ## s1: The first string.
## ##
@ -748,7 +748,7 @@ function string_to_ascii_hex%(s: string%): string
%} %}
## Uses the Smith-Waterman algorithm to find similar/overlapping substrings. ## Uses the Smith-Waterman algorithm to find similar/overlapping substrings.
## See `Wikipedia <http://en.wikipedia.org/wiki/Smith%E2%80%93Waterman_algorithm>`__. ## See `Wikipedia <https://en.wikipedia.org/wiki/Smith%E2%80%93Waterman_algorithm>`__.
## ##
## s1: The first string. ## s1: The first string.
## ##

6
src/zeek.bif
View file

@ -1206,7 +1206,7 @@ function fnv1a64%(input: any%): count
## Calculates a weight value for use in a Rendezvous Hashing algorithm. ## Calculates a weight value for use in a Rendezvous Hashing algorithm.
## See `<https://en.wikipedia.org/wiki/Rendezvous_hashing>`_. ## See `<https://en.wikipedia.org/wiki/Rendezvous_hashing>`_.
## The weight function used is the one recommended in the original ## The weight function used is the one recommended in the original
## paper: `<http://www.eecs.umich.edu/techreports/cse/96/CSE-TR-316-96.pdf>`_. ## paper: `<https://www.eecs.umich.edu/techreports/cse/96/CSE-TR-316-96.pdf>`_.
## ##
## key_digest: A 32-bit digest of a key. E.g. use :zeek:see:`fnv1a32` to ## key_digest: A 32-bit digest of a key. E.g. use :zeek:see:`fnv1a32` to
## produce this. ## produce this.
@ -1318,7 +1318,7 @@ function file_magic%(data: string%): mime_matches
%} %}
## Performs an entropy test on the given data. ## Performs an entropy test on the given data.
## See http://www.fourmilab.ch/random. ## See https://www.fourmilab.ch/random.
## ##
## data: The data to compute the entropy for. ## data: The data to compute the entropy for.
## ##
@ -3621,7 +3621,7 @@ struct zeek_uuid_t {
## Converts a bytes representation of a UUID into its string form. For example, ## Converts a bytes representation of a UUID into its string form. For example,
## given a string of 16 bytes, it produces an output string in this format: ## given a string of 16 bytes, it produces an output string in this format:
## ``550e8400-e29b-41d4-a716-446655440000``. ## ``550e8400-e29b-41d4-a716-446655440000``.
## See `<http://en.wikipedia.org/wiki/Universally_unique_identifier>`_. ## See `<https://en.wikipedia.org/wiki/Universally_unique_identifier>`_.
## ##
## uuid: The 16 bytes of the UUID. ## uuid: The 16 bytes of the UUID.
## ##