.. _spicy_confirm_protocol:

.. rubric:: ``function zeek::confirm_protocol()``

[Deprecated] Triggers a DPD protocol confirmation for the current connection.

This function has been deprecated and will be removed. Use ``spicy::accept_input``
instead, which will have the same effect with Zeek.

.. _spicy_reject_protocol:

.. rubric:: ``function zeek::reject_protocol(reason: string)``

[Deprecated] Triggers a DPD protocol violation for the current connection.

This function has been deprecated and will be removed. Use ``spicy::decline_input``
instead, which will have the same effect with Zeek.

.. _spicy_weird:

.. rubric:: ``function zeek::weird(id: string, addl: string = "") : &cxxname="spicy::zeek::rt::weird";``

Reports a "weird" to Zeek. This should be used with similar semantics as in
Zeek: something quite unexpected happening at the protocol level, which however
does not prevent us from continuing to process the connection.

id: the name of the weird, which (just like in Zeek) should be a *static*
string identifying the situation reported (e.g., ``unexpected_command``).

addl: additional information to record along with the weird

.. _spicy_is_orig:

.. rubric:: ``function zeek::is_orig() : bool``

Returns true if we're currently parsing the originator side of a connection.

.. _spicy_uid:

.. rubric:: ``function zeek::uid() : string``

Returns the current connection's UID.

.. _spicy_conn_id:

.. rubric:: ``function zeek::conn_id() : tuple<orig_h: addr, orig_p: port, resp_h: addr, resp_p: port>``

Returns the current connection's 4-tuple ID.

.. _spicy_flip_roles:

.. rubric:: ``function zeek::flip_roles()``

Instructs Zeek to flip the directionality of the current connection.

.. _spicy_number_packets:

.. rubric:: ``function zeek::number_packets() : uint64``

Returns the number of packets seen so far on the current side of the current connection.

.. _spicy_protocol_begin:

.. rubric:: ``function zeek::protocol_begin(analyzer: optional<string> = Null)``

Adds a Zeek-side child protocol analyzer to the current connection.

analyzer: type of analyzer to instantiate, specified through its Zeek-side
name (similar to what Zeek's signature action `enable` takes); if not
specified, Zeek will perform its usual dynamic protocol detection to figure
out how to parse the data (the latter will work only for TCP protocols, though.)

.. _spicy_protocol_data_in:

.. rubric:: ``function zeek::protocol_data_in(is_orig: bool, data: bytes)``

Forwards protocol data to all previously instantiated Zeek-side child protocol analyzers.

is_orig: true to feed the data to the child's originator side, false for the responder
data: chunk of data to forward to child analyzer

Note that due to Zeek limitations, any data passed through this function will always
be forwarded to *all* currently active child analyzers.

.. _spicy_protocol_gap:

.. rubric:: ``function zeek::protocol_gap(is_orig: bool, offset: uint64, len: uint64)``

Signals a gap in input data to all previously instantiated Zeek-side child protocol analyzers.

is_orig: true to signal gap to the child's originator side, false for the responder
offset: start offset of gap in input stream
len: size of gap

Note that due to Zeek limitations, any gaps signaled through this function will always
be forwarded to *all* currently active child analyzers.

.. _spicy_protocol_end:

.. rubric:: ``function zeek::protocol_end()``

Signals end-of-data to all previously instantiated Zeek-side child protocol
analyzers and removes them.

.. _spicy_file_begin:

.. rubric:: ``function zeek::file_begin(mime_type: optional<string> = Null) : string``

Signals the beginning of a file to Zeek's file analysis, associating it with the current connection.
Optionally, a mime type can be provided. It will be passed on to Zeek's file analysis framework.
Returns the Zeek-side file ID of the new file.

.. _spicy_fuid:

.. rubric:: ``function zeek::fuid() : string``

Returns the current file's FUID.

.. _spicy_terminate_session:

.. rubric:: ``function zeek::terminate_session()``

Terminates the currently active Zeek-side session, flushing all state. Any
subsequent activity will start a new session from scratch. This can only be
called from inside a protocol analyzer.

.. _spicy_file_set_size:

.. rubric:: ``function zeek::file_set_size(size: uint64, fid: optional<string> = Null)``

Signals the expected size of a file to Zeek's file analysis.

size: expected size of file
fid: Zeek-side ID of the file to operate on; if not given, the file started by the most recent file_begin() will be used

.. _spicy_file_data_in:

.. rubric:: ``function zeek::file_data_in(data: bytes, fid: optional<string> = Null)``

Passes file content on to Zeek's file analysis.

data: chunk of raw data to pass into analysis
fid: Zeek-side ID of the file to operate on; if not given, the file started by the most recent file_begin() will be used

.. _spicy_file_data_in_at_offset:

.. rubric:: ``function zeek::file_data_in_at_offset(data: bytes, offset: uint64, fid: optional<string> = Null)``

Passes file content at a specific offset on to Zeek's file analysis.

data: chunk of raw data to pass into analysis
offset: position in file where data starts
fid: Zeek-side ID of the file to operate on; if not given, the file started by the most recent file_begin() will be used

.. _spicy_file_gap:

.. rubric:: ``function zeek::file_gap(offset: uint64, len: uint64, fid: optional<string> = Null)``

Signals a gap in a file to Zeek's file analysis.

offset: position in file where gap starts
len: size of gap
fid: Zeek-side ID of the file to operate on; if not given, the file started by the most recent file_begin() will be used

.. _spicy_file_end:

.. rubric:: ``function zeek::file_end(fid: optional<string> = Null)``

Signals the end of a file to Zeek's file analysis.

fid: Zeek-side ID of the file to operate on; if not given, the file started by the most recent file_begin() will be used

.. _spicy_forward_packet:

.. rubric:: ``function zeek::forward_packet(identifier: uint32)``

Inside a packet analyzer, forwards what data remains after parsing the top-level unit
on to another analyzer. The index specifies the target, per the current dispatcher table.

.. _spicy_network_time:

.. rubric:: ``function zeek::network_time() : time``

Gets the network time from Zeek.

