zeek/tools/bifcl
Tim Wojtulewicz 02fe78a03f bifcl: Allow analyzer to be passed as nullptr for enqueue methods
This allows the methods to be used in contexts where the analyzer ID
is not available or when the ID doesn't matter, such as in packet
analyzers.
2025-08-20 08:52:25 -07:00
..
include bifcl: Rename Session::ConnVal() to Session::GetVal() 2025-08-20 08:52:25 -07:00
bif_arg.cc bifcl: Remove v4.1 deprecation warnings 2025-08-20 08:52:25 -07:00
builtin-func.l bifcl: Prevent use of LeakSanitizer on FreeBSD 2025-08-20 08:52:25 -07:00
builtin-func.y bifcl: Allow analyzer to be passed as nullptr for enqueue methods 2025-08-20 08:52:25 -07:00
CMakeLists.txt bifcl: Updates for building Zeek as a subproject 2025-08-20 08:52:25 -07:00
module_util.cc bifcl: Port bifcl code from Bro 2025-08-20 08:52:24 -07:00
README bifcl: Rename Bro to Zeek 2025-08-20 08:52:24 -07:00

.. _Zeek: https://www.zeek.org

=================
Zeek BIF Compiler
=================

The ``bifcl`` program simply takes a ``.bif`` file as input and
generates C++ header/source files along with a ``.zeek`` script
that all-together provide the declaration and implementation of Zeek_
Built-In-Functions (BIFs), which can then be compiled and shipped
as part of a Zeek plugin.

A BIF allows one to write arbitrary C++ code and access it via a
function call inside a Zeek script.  In this way, they can also be
used to access parts of Zeek's internal C++ API that aren't already
exposed via their own BIFs.

At the moment, learning the format of a ``.bif`` file is likely easiest
by just taking a look at the ``.bif`` files inside the Zeek source-tree.