# $Id: event.bif,v 1.6 2003/08/31 00:38:11 vern Exp $

event bro_init%(%);
event bro_done%(%);

# bro_signal is initiated in main.cc
# event bro_signal%(signal: count%);

# no_handler is initiated in main.cc
# event no_handler%(name: string, val: any%);

event dns_mapping_valid%(dm: dns_mapping%);
event dns_mapping_unverified%(dm: dns_mapping%);
event dns_mapping_new_name%(dm: dns_mapping%);
event dns_mapping_lost_name%(dm: dns_mapping%);
event dns_mapping_name_changed%(old_dm: dns_mapping, new_dm: dns_mapping%);
event dns_mapping_altered%(dm: dns_mapping, old_addrs: addr_set, new_addrs: addr_set%);

event new_connection%(c: connection%);
event new_connection_contents%(c: connection%);
event connection_attempt%(c: connection%);
event connection_established%(c: connection%);
event partial_connection%(c: connection%);
event connection_partial_close%(c: connection%);
event connection_finished%(c: connection%);
event connection_half_finished%(c: connection%);
event connection_rejected%(c: connection%);
event connection_reset%(c: connection%);
event connection_pending%(c: connection%);
event connection_state_remove%(c: connection%);
event connection_SYN_packet%(c: connection, pkt: SYN_packet%);
event connection_timeout%(c: connection%);
event connection_reused%(c: connection%);
event connection_status_update%(c: connection%);

event packet_contents%(c: connection, contents: string%);
event udp_request%(u: connection%);
event udp_reply%(u: connection%);
event udp_session_done%(u: connection%);
event icmp_sent%(icmp: icmp_conn%);
event icmp_echo_request%(icmp: icmp_conn, id: count, seq: count, payload: string%);
event icmp_echo_reply%(icmp: icmp_conn, id: count, seq: count, payload: string%);
event icmp_unreachable%(icmp: icmp_conn, code: count, context: icmp_context%);
event net_stats_update%(t: time, ns: net_stats%);
event conn_stats%(c: connection, os: endpoint_stats, rs: endpoint_stats%);
event conn_weird%(name: string, c: connection%);
event conn_weird_addl%(name: string, c: connection, addl: string%);
event flow_weird%(name: string, src: addr, dst: addr%);
event net_weird%(name: string%);
event rexmit_inconsistency%(c: connection, t1: string, t2: string%);
event ack_above_hole%(c: connection%);
event content_gap%(c: connection, is_orig: bool, seq: count, length: count%);
event inconsistent_option%(c: connection%);
event bad_option%(c: connection%);
event bad_option_termination%(c: connection%);

event finger_request%(c: connection, full: bool, username: string, hostname: string%);
event finger_reply%(c: connection, reply_line: string%);

event ident_request%(c: connection, lport: port, rport: port%);
event ident_reply%(c: connection, lport: port, rport: port, user_id: string, system: string%);
event ident_error%(c: connection, lport: port, rport: port, line: string%);

event login_failure%(c: connection, user: string, client_user: string, password: string, line: string%);
event login_success%(c: connection, user: string, client_user: string, password: string, line: string%);
event login_input_line%(c: connection, line: string%);
event login_output_line%(c: connection, line: string%);
event login_confused%(c: connection, msg: string, line: string%);
event login_confused_text%(c: connection, line: string%);
event login_terminal%(c: connection, terminal: string%);
event login_display%(c: connection, display: string%);
event login_prompt%(c: connection, prompt: string%);
event excessive_line%(c: connection%);
event authentication_accepted%(name: string, c: connection%);
event authentication_rejected%(name: string, c: connection%);
event authentication_skipped%(c: connection%);
event activating_encryption%(c: connection%);

event ftp_request%(c: connection, command: string, arg: string%);
event ftp_reply%(c: connection, code: count, msg: string, cont_resp: bool%);

event smtp_request%(c: connection, is_orig: bool, command: string, arg: string%);
event smtp_reply%(c: connection, is_orig: bool, code: count, cmd: string, msg: string, cont_resp: bool%);
event smtp_data%(c: connection, is_orig: bool, data: string%);
event smtp_unexpected%(c: connection, is_orig: bool, msg: string, detail: string%);

event mime_begin_entity%(c: connection%);
event mime_next_entity%(c: connection%);
event mime_end_entity%(c: connection%);
event mime_one_header%(c: connection, h: mime_header_rec%);
event mime_all_headers%(c: connection, hlist: mime_header_list%);
event mime_segment_data%(c: connection, length: count, data: string%);
event mime_entity_data%(c: connection, length: count, data: string%);
event mime_all_data%(c: connection, length: count, data: string%);
event mime_event%(c: connection, event_type: string, detail: string%);
event mime_content_hash%(c: connection, hash_value: string%);

event pm_request_null%(r: connection%);
event pm_request_set%(r: connection, m: pm_mapping, success: bool%);
event pm_request_unset%(r: connection, m: pm_mapping, success: bool%);
event pm_request_getport%(r: connection, pr: pm_port_request, p: port%);
event pm_request_dump%(r: connection, m: pm_mappings%);
event pm_request_callit%(r: connection, call: pm_callit_request, p: port%);
event pm_attempt_null%(r: connection, status: count%);
event pm_attempt_set%(r: connection, status: count, m: pm_mapping%);
event pm_attempt_unset%(r: connection, status: count, m: pm_mapping%);
event pm_attempt_getport%(r: connection, status: count, pr: pm_port_request%);
event pm_attempt_dump%(r: connection, status: count%);
event pm_attempt_callit%(r: connection, status: count, call: pm_callit_request%);
event pm_bad_port%(r: connection, bad_p: count%);

event ntp_message%(u: connection, msg: ntp_msg, excess: string%);

event netbios_session_request%(c: connection, msg: string%);
event netbios_session_accepted%(c: connection, msg: string%);
event netbios_session_rejected%(c: connection, msg: string%);
event netbios_session_message%(c: connection, msg: string%);
event netbios_session_ret_arg_resp%(c: connection, msg: string%);
event netbios_session_keepalive%(c: connection, msg: string%);

event dns_request%(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count%);
event dns_full_request%(%);
event dns_rejected%(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count%);
event dns_A_reply%(c: connection, msg: dns_msg, ans: dns_answer, a: addr%);
event dns_NS_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string%);
event dns_CNAME_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string%);
event dns_PTR_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string%);
event dns_SOA_reply%(c: connection, msg: dns_msg, ans: dns_answer, soa: dns_soa%);
event dns_WKS_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
event dns_HINFO_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
event dns_MX_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string, preference: count%);
event dns_TXT_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
event dns_SRV_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
event dns_EDNS0%(c: connection, msg: dns_msg, ans: dns_answer%);

event http_request%(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string%);
event http_reply%(c: connection, version: string, code: count, reason: string%);
event http_header%(c: connection, is_orig: bool, name: string, value: string%);
event http_all_headers%(c: connection, is_orig: bool, hlist: mime_header_list%);
event http_begin_entity%(c: connection, is_orig: bool%);
event http_end_entity%(c: connection, is_orig: bool%);
event http_content_type%(c: connection, is_orig: bool, ty: string, subty: string%);
event http_entity_data%(c: connection, is_orig: bool, length: count, data: string%);
event http_message_done%(c: connection, is_orig: bool, stat: http_message_stat%);
event http_event%(c: connection, event_type: string, detail: string%);
event http_stats%(c: connection, stats: http_stats_rec%);

event ssh_client_version%(c: connection, version: string%);
event ssh_server_version%(c: connection, version: string%);
event stp_create_endp%(c: connection, e: int, is_orig: bool%);
event stp_resume_endp%(e: int%);
event stp_correlate_pair%(e1: int, e2: int%);
event stp_remove_pair%(e1: int, e2: int%);
event stp_remove_endp%(e: int%);

event interconn_stats%(c: connection, os: interconn_endp_stats, rs: interconn_endp_stats%);
event interconn_remove_conn%(c: connection%);

event backdoor_stats%(c: connection, os: backdoor_endp_stats, rs: backdoor_endp_stats%);
event backdoor_remove_conn%(c: connection%);
event ssh_signature_found%(c: connection, is_orig: bool%);
event telnet_signature_found%(c: connection, is_orig: bool, len: count%);
event rlogin_signature_found%(c: connection, is_orig: bool, num_null: count, len: count%);
event root_backdoor_signature_found%(c: connection%);
event ftp_signature_found%(c: connection%);
event napster_signature_found%(c: connection%);
event gnutella_signature_found%(c: connection%);
event kazaa_signature_found%(c: connection%);
event http_signature_found%(c: connection%);
event http_proxy_signature_found%(c: connection%);

event signature_match%(state: signature_state, msg: string, data: string%);

# Generated if a handler finds an identification of the software used in server.
event software_version_found%(host: addr, s: software, raw: string%);

# Generated if a handler finds a version but cannot parse it.
event software_parse_error%(host: addr, s: string%);

# Generated when an IP address gets mapped for the first time
event anonymization_mapping%(orig: addr, mapped: addr%);
