Camel-cased, no underscores (all uppercase for abbreviations)
Examples: FTP, SSH, Notice, Remote, Signatures
Camel-cased, no underscores
Examples: Log, Connection, EntropyTestResult, GeoLocation, Packet
Lower-cased with underscores
Examples: example_variable, ftp_sessions
Upper-cased with underscores
Examples: KNOWN_HOSTS, SSH, NFS3_REG
(This is a special case of naming enum values)
Camel-cased with underscores
Examples: Off_Port_Protocol_Found, Malware_Hash_Registry_Match, Site_Exec_Success
Scripts that go into Bro’s “base” scripts directory have some rules they must follow to be considered for inclusion. This is to enforce some consistency among the scripts as we move toward referring to them as the Bro Standard Library.
- No printing! Use the reporter instead (the BiFs, not the events!).
- Frameworks shouldn’t cause any performance overhead merely by the act of loading them.
- Protocol scripts (in base) shouldn’t generate any notices.
- All consts in export sections must be tagged with &redef.
- No reconfiguring variables with redef. If a default setting is incorrect for some scenario then a larger discussion may need to take place about the default value.