Update to upstream version 2.4.1, add BROKER OPTION

PR:		203849
Submitted by:	leres@ee.lbl.gov (maintainer)

security/bro/Makefile

@@ -2,7 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	bro
-PORTVERSION=	2.3.2
+PORTVERSION=	2.4.1
 CATEGORIES=	security
 MASTER_SITES=	http://www.bro.org/downloads/release/
 
@@ -15,9 +15,10 @@ BUILD_DEPENDS=	${LOCALBASE}/bin/bison:${PORTSDIR}/devel/bison \
 		${LOCALBASE}/bin/swig:${PORTSDIR}/devel/swig13
 LIB_DEPENDS=	libGeoIP.so:${PORTSDIR}/net/GeoIP
 
-USES=		cmake:outsource perl5 python
+USES=		cmake:outsource compiler:c++11-lang perl5 python
 
 CMAKE_ARGS+=	-D PYTHON_EXECUTABLE:PATH=${PYTHON_CMD}
+CXXFLAGS+=	-std=c++11 -Wextra -Wall -pedantic
 
 SUB_FILES=	pkg-message
 NO_MTREE=	yes
@@ -33,6 +34,7 @@ CMAKE_ARGS+=	-D CMAKE_INSTALL_PREFIX:PATH=${PREFIX} \
 		-D PY_MOD_INSTALL_DIR:PATH=${PREFIX}/lib/broctl \
 		-D BRO_SCRIPT_INSTALL_PATH:PATH=${PREFIX}/share/bro \
 		-D BRO_ETC_INSTALL_DIR:PATH=${PREFIX}/etc \
+		-D BRO_MAN_INSTALL_PATH=${MANPREFIX}/man \
 		-D ENABLE_PERFTOOLS:BOOL=false \
 		-D ENABLE_PERFTOOLS_DEBUG:BOOL=false \
 		-D BinPAC_SKIP_INSTALL:BOOL=true \
@@ -49,13 +51,13 @@ GROUPS=		${BROGROUP}
 
 USE_OPENSSL=	yes
 
-OPTIONS_DEFINE=	BROCCOLI BROCTL DEBUG ELASTICSEARCH IPSUMDUMP LBL_CF LBL_HF PERFTOOLS PORTS_SSL
+OPTIONS_DEFINE= BROCCOLI BROCTL BROKER DEBUG IPSUMDUMP LBL_CF LBL_HF PERFTOOLS PORTS_SSL
 OPTIONS_DEFAULT=BROCCOLI BROCTL IPSUMDUMP LBL_CF LBL_HF PORTS_SSL
 
 BROCCOLI_DESC=	Build support for libbroccoli communications
 BROCTL_DESC=	Build BroControl support (requires BROCCOLI)
+BROKER_DESC=	Enable the Broker communication library
 DEBUG_DESC=	Compile in debugging mode
-ELASTICSEARCH_DESC=	Build the ElasticSearch log writer (requires curl)
 IPSUMDUMP_DESC=	Enables traffic summaries
 LBL_CF_DESC=	Unix time to formated time/date filter support
 LBL_HF_DESC=	Address to hostname filter support
@@ -86,8 +88,10 @@ IGNORE=		the BROCTL option requires BROCCOLI
 .if empty(PORT_OPTIONS:MIPSUMDUMP)
 IGNORE=		the BROCTL option requires IPSUMDUMP
 .endif
-BUILD_DEPENDS+=	${LOCALBASE}/bin/bash:${PORTSDIR}/shells/bash
+BUILD_DEPENDS+=	${LOCALBASE}/bin/bash:${PORTSDIR}/shells/bash \
-RUN_DEPENDS+=	${LOCALBASE}/bin/bash:${PORTSDIR}/shells/bash
+		${PYTHON_PKGNAMEPREFIX}sqlite3>0:${PORTSDIR}/databases/py-sqlite3
+RUN_DEPENDS+=	${LOCALBASE}/bin/bash:${PORTSDIR}/shells/bash \
+		${PYTHON_PKGNAMEPREFIX}sqlite3>0:${PORTSDIR}/databases/py-sqlite3
 PLIST_SUB+=	BROCTL=""
 USE_LDCONFIG=	yes
 CMAKE_ARGS+=	-D INSTALL_BROCTL:BOOL=true
@@ -96,11 +100,22 @@ CMAKE_ARGS+=	-D INSTALL_BROCTL:BOOL=false
 PLIST_SUB+=	BROCTL="@comment "
 .endif
 
-.if ${PORT_OPTIONS:MELASTICSEARCH}
+.if ${PORT_OPTIONS:MBROKER}
-CMAKE_ARGS+=	-D DISABLE_ELASTICSEARCH:BOOL=false
+CMAKE_ARGS+=	-D ENABLE_BROKER:BOOL=true
-LIB_DEPENDS+=	libcurl.so:${PORTSDIR}/ftp/curl
+BUILD_DEPENDS+=	caf>=0.14.1:${PORTSDIR}/devel/caf
+PLIST_SUB+=	BROKER=""
+
+.if ${OSVERSION} < 1001000
+# Bro 2.4 with BROKER requires caf, clang and libc++
+BUILD_DEPENDS+=	${LOCALBASE}/bin/clang++34:${PORTSDIR}/lang/clang34 \
+		${LOCALBASE}/lib/c++/libstdc++.so:${PORTSDIR}/devel/libc++
+
+CXXFLAGS+=	-stdlib=libc++ -I${LOCALBASE}/include/c++/v1 -L${LOCALBASE}/lib
+CXX=		${LOCALBASE}/bin/clang++34
+.endif
 .else
-CMAKE_ARGS+=	-D DISABLE_ELASTICSEARCH:BOOL=true
+CMAKE_ARGS+=	-D ENABLE_BROKER:BOOL=false
+PLIST_SUB+=	BROKER="@comment "
 .endif
 
 .if ${PORT_OPTIONS:MDEBUG}

security/bro/distinfo

@@ -1,2 +1,2 @@
-SHA256 (bro-2.3.2.tar.gz) = 2fe5fbda0a86b5a594116d567fd9a4c2458d30f1c6670ba8e1fac0bc8848c69b
+SHA256 (bro-2.4.1.tar.gz) = d8b99673a5024630f6bae820c4f8c3ca9029f1167f9e5729c914c66e1fc7c8f6
-SIZE (bro-2.3.2.tar.gz) = 10290134
+SIZE (bro-2.4.1.tar.gz) = 15010455

security/bro/files/patch-aux-broker-CMakeLists.txt

@@ -0,0 +1,11 @@
+--- aux/broker/CMakeLists.txt.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/CMakeLists.txt
+@@ -5,7 +5,7 @@ include(cmake/CommonCMakeConfig.cmake)
+ find_package(Libcaf COMPONENTS core io REQUIRED)
+ 
+ # Check for required CAF version.
+-set(CAF_VERSION_REQUIRED 0.13)
++set(CAF_VERSION_REQUIRED 0.14)
+ file(READ "${LIBCAF_INCLUDE_DIR_CORE}/caf/config.hpp" caf_config_hpp)
+ string(REGEX MATCH "#define CAF_VERSION [0-9]+"
+        caf_version_line "${caf_config_hpp}")

security/bro/files/patch-aux-broker-README

@@ -0,0 +1,11 @@
+--- aux/broker/README.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/README
+@@ -35,7 +35,7 @@ installed:
+ 
+     A C++11 capable compiler (GCC 4.8+ or Clang 3.3+)
+ 
+-    CAF (C++ Actor Framework) version 0.13+
++    CAF (C++ Actor Framework) version 0.14+
+         https://github.com/actor-framework/actor-framework
+ 
+     CMake 2.8+

security/bro/files/patch-aux-broker-src-address_type_info.hh

@@ -0,0 +1,26 @@
+--- aux/broker/src/address_type_info.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/address_type_info.hh
+@@ -2,7 +2,7 @@
+ #define BROKER_ADDRESS_TYPE_INFO_HH
+ 
+ #include "broker/address.hh"
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ 
+@@ -11,12 +11,11 @@ namespace broker {
+ /**
+  * (de)serialization logic for type "address".
+  */
+-class address_type_info
+-      : public caf::detail::abstract_uniform_type_info<address> {
++class address_type_info : public caf::abstract_uniform_type_info<address> {
+ public :
+ 
+ 	address_type_info()
+-		: caf::detail::abstract_uniform_type_info<address>("broker::address")
++		: caf::abstract_uniform_type_info<address>("broker::address")
+ 		{}
+ 
+ 	void serialize(const void* ptr, caf::serializer* sink) const override

security/bro/files/patch-aux-broker-src-data_type_info.hh

@@ -0,0 +1,39 @@
+--- aux/broker/src/data_type_info.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/data_type_info.hh
+@@ -2,7 +2,7 @@
+ #define BROKER_DATA_TYPE_INFO_HH
+ 
+ #include "broker/data.hh"
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ 
+@@ -11,11 +11,11 @@ namespace broker {
+ /**
+  * (de)serialization logic for type "data".
+  */
+-class data_type_info : public caf::detail::abstract_uniform_type_info<data> {
++class data_type_info : public caf::abstract_uniform_type_info<data> {
+ public:
+ 
+ 	data_type_info()
+-		: caf::detail::abstract_uniform_type_info<data>("broker::data")
++		: caf::abstract_uniform_type_info<data>("broker::data")
+ 		{}
+ 
+ 	struct serializer {
+@@ -58,11 +58,11 @@ public:
+  * (de)serialization logic for type "optional<data>".
+  */
+ class optional_data_type_info :
+-      public caf::detail::abstract_uniform_type_info<util::optional<data>> {
++      public caf::abstract_uniform_type_info<util::optional<data>> {
+ public:
+ 
+ 	optional_data_type_info()
+-		: caf::detail::abstract_uniform_type_info<util::optional<data>>(
++		: caf::abstract_uniform_type_info<util::optional<data>>(
+ 	          "broker::util::optional<data>")
+ 		{}
+ 

security/bro/files/patch-aux-broker-src-endpoint_impl.hh

@@ -0,0 +1,71 @@
+--- aux/broker/src/endpoint_impl.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/endpoint_impl.hh
+@@ -12,7 +12,7 @@
+ #include <caf/actor.hpp>
+ #include <caf/spawn.hpp>
+ #include <caf/send.hpp>
+-#include <caf/sb_actor.hpp>
++#include <caf/event_based_actor.hpp>
+ #include <caf/scoped_actor.hpp>
+ #include <caf/io/remote_actor.hpp>
+ #include <unordered_set>
+@@ -62,8 +62,7 @@ static void ics_update(const caf::actor&
+                        incoming_connection_status::tag t)
+ 	{ caf::anon_send(q, incoming_connection_status{t, std::move(name)}); }
+ 
+-class endpoint_actor : public caf::sb_actor<endpoint_actor> {
+-friend class caf::sb_actor<endpoint_actor>;
++class endpoint_actor : public caf::event_based_actor {
+ 
+ public:
+ 
+@@ -351,6 +350,11 @@ public:
+ 
+ private:
+ 
++	caf::behavior make_behavior() override
++		{
++		return active;
++		}
++
+ 	std::string get_peer_name(const caf::actor_addr& a) const
+ 		{
+ 		auto it = peers.find(a);
+@@ -473,7 +477,6 @@ private:
+ 	};
+ 
+ 	caf::behavior active;
+-	caf::behavior& init_state = active;
+ 
+ 	std::string name;
+ 	int behavior_flags;
+@@ -490,8 +493,7 @@ private:
+  * Manages connection to a remote endpoint_actor including auto-reconnection
+  * and associated peer/unpeer messages.
+  */
+-class endpoint_proxy_actor : public caf::sb_actor<endpoint_proxy_actor> {
+-friend class caf::sb_actor<endpoint_proxy_actor>;
++class endpoint_proxy_actor : public caf::event_based_actor {
+ 
+ public:
+ 
+@@ -571,6 +573,11 @@ public:
+ 
+ private:
+ 
++	caf::behavior make_behavior() override
++		{
++		return bootstrap;
++		}
++
+ 	std::string report_subtopic(const std::string& endpoint_name,
+ 	                            const std::string& addr, uint16_t port) const
+ 		{
+@@ -615,7 +622,6 @@ private:
+ 	caf::behavior bootstrap;
+ 	caf::behavior disconnected;
+ 	caf::behavior connected;
+-	caf::behavior& init_state = bootstrap;
+ };
+ 
+ static inline caf::actor& handle_to_actor(void* h)

security/bro/files/patch-aux-broker-src-peering_type_info.hh

@@ -0,0 +1,26 @@
+--- aux/broker/src/peering_type_info.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/peering_type_info.hh
+@@ -2,7 +2,7 @@
+ #define BROKER_PEERING_TYPE_INFO_HH
+ 
+ #include "peering_impl.hh"
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ 
+@@ -11,12 +11,11 @@ namespace broker {
+ /**
+  * (de)serialization logic for type "peering".
+  */
+-class peering_type_info
+-      : public caf::detail::abstract_uniform_type_info<peering> {
++class peering_type_info : public caf::abstract_uniform_type_info<peering> {
+ public:
+ 
+ 	peering_type_info()
+-		: caf::detail::abstract_uniform_type_info<peering>("broker::peering")
++		: caf::abstract_uniform_type_info<peering>("broker::peering")
+ 		{}
+ 
+ 	void serialize(const void* ptr, caf::serializer* sink) const override

security/bro/files/patch-aux-broker-src-port_type_info.hh

@@ -0,0 +1,26 @@
+--- aux/broker/src/port_type_info.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/port_type_info.hh
+@@ -3,7 +3,7 @@
+ 
+ #include "broker/port.hh"
+ #include <type_traits>
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ 
+@@ -12,12 +12,11 @@ namespace broker {
+ /**
+  * (de)serialization logic for type "port".
+  */
+-class port_type_info
+-      : public caf::detail::abstract_uniform_type_info<port> {
++class port_type_info : public caf::abstract_uniform_type_info<port> {
+ public :
+ 
+ 	port_type_info()
+-		: caf::detail::abstract_uniform_type_info<port>("broker::port")
++		: caf::abstract_uniform_type_info<port>("broker::port")
+ 		{}
+ 
+ 	void serialize(const void* ptr, caf::serializer* sink) const override

security/bro/files/patch-aux-broker-src-queue_impl.hh

@@ -0,0 +1,11 @@
+--- aux/broker/src/queue_impl.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/queue_impl.hh
+@@ -18,7 +18,7 @@ public:
+ 		util::flare f;
+ 		fd = f.fd();
+ 		actor = caf::spawn<
+-		        broker::util::queue_actor<decltype(caf::on<T>()), T>,
++		        broker::util::queue_actor<T>,
+ 		        caf::priority_aware>(std::move(f));
+ 		self->planned_exit_reason(caf::exit_reason::user_defined);
+ 		actor->link_to(self);

security/bro/files/patch-aux-broker-src-store-clone_impl.hh

@@ -0,0 +1,38 @@
+--- aux/broker/src/store/clone_impl.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/store/clone_impl.hh
+@@ -10,13 +10,12 @@
+ #include <caf/spawn.hpp>
+ #include <caf/send.hpp>
+ #include <caf/actor.hpp>
+-#include <caf/sb_actor.hpp>
++#include <caf/event_based_actor.hpp>
+ #include <caf/scoped_actor.hpp>
+ 
+ namespace broker { namespace store {
+ 
+-class clone_actor : public caf::sb_actor<clone_actor> {
+-friend class caf::sb_actor<clone_actor>;
++class clone_actor : public caf::event_based_actor {
+ 
+ public:
+ 
+@@ -320,6 +319,11 @@ public:
+ 
+ private:
+ 
++	caf::behavior make_behavior() override
++		{
++		return bootstrap;
++		}
++
+ 	void error(std::string master_name, std::string method_name,
+ 	           std::string err_msg, bool fatal = false)
+ 		{
+@@ -359,7 +363,6 @@ private:
+ 	caf::behavior synchronizing;
+ 	caf::behavior active;
+ 	caf::behavior dead;
+-	caf::behavior& init_state = bootstrap;
+ };
+ 
+ 

security/bro/files/patch-aux-broker-src-store-frontend.cc

@@ -0,0 +1,10 @@
+--- aux/broker/src/store/frontend.cc.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/store/frontend.cc
+@@ -1,7 +1,6 @@
+ #include "frontend_impl.hh"
+ #include "../atoms.hh"
+ #include <caf/send.hpp>
+-#include <caf/sb_actor.hpp>
+ #include <caf/spawn.hpp>
+ 
+ static inline caf::actor& handle_to_actor(void* h)

security/bro/files/patch-aux-broker-src-store-frontend_impl.hh

@@ -0,0 +1,33 @@
+--- aux/broker/src/store/frontend_impl.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/store/frontend_impl.hh
+@@ -3,13 +3,12 @@
+ 
+ #include "broker/store/frontend.hh"
+ #include <caf/actor.hpp>
+-#include <caf/sb_actor.hpp>
++#include <caf/event_based_actor.hpp>
+ #include <caf/scoped_actor.hpp>
+ 
+ namespace broker { namespace store {
+ 
+-class requester : public caf::sb_actor<requester> {
+-friend class caf::sb_actor<requester>;
++class requester : public caf::event_based_actor {
+ 
+ public:
+ 
+@@ -46,9 +45,13 @@ public:
+ 
+ private:
+ 
++	caf::behavior make_behavior() override
++		{
++		return bootstrap;
++		}
++
+ 	caf::behavior bootstrap;
+ 	caf::behavior awaiting_response;
+-	caf::behavior& init_state = bootstrap;
+ 	query request;
+ };
+ 

security/bro/files/patch-aux-broker-src-store-master_impl.hh

@@ -0,0 +1,41 @@
+--- aux/broker/src/store/master_impl.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/store/master_impl.hh
+@@ -9,7 +9,7 @@
+ #include <caf/send.hpp>
+ #include <caf/spawn.hpp>
+ #include <caf/actor.hpp>
+-#include <caf/sb_actor.hpp>
++#include <caf/event_based_actor.hpp>
+ #include <caf/scoped_actor.hpp>
+ #include <unordered_map>
+ 
+@@ -18,8 +18,7 @@ namespace broker { namespace store {
+ static inline double now()
+ 	{ return broker::time_point::now().value; }
+ 
+-class master_actor : public caf::sb_actor<master_actor> {
+-friend class caf::sb_actor<master_actor>;
++class master_actor : public caf::event_based_actor {
+ 
+ public:
+ 
+@@ -282,6 +281,11 @@ public:
+ 
+ private:
+ 
++	caf::behavior make_behavior() override
++		{
++		return init_existing_expiry_reminders;
++		}
++
+ 	void expiry_reminder(const identifier& name, data key,
+ 	                     expiration_time expiry)
+ 		{
+@@ -324,7 +328,6 @@ private:
+ 	std::unordered_map<caf::actor_addr, caf::actor> clones;
+ 	caf::behavior serving;
+ 	caf::behavior init_existing_expiry_reminders;
+-	caf::behavior& init_state = init_existing_expiry_reminders;
+ };
+ 
+ class master::impl {

security/bro/files/patch-aux-broker-src-store-result_type_info.hh

@@ -0,0 +1,25 @@
+--- aux/broker/src/store/result_type_info.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/store/result_type_info.hh
+@@ -2,7 +2,7 @@
+ #define BROKER_STORE_RESULT_TYPE_INFO_HH
+ 
+ #include "broker/store/result.hh"
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ 
+@@ -12,11 +12,11 @@ namespace broker { namespace store {
+  * (de)serialization logic for type "result".
+  */
+ class result_type_info
+-        : public caf::detail::abstract_uniform_type_info<result> {
++        : public caf::abstract_uniform_type_info<result> {
+ public:
+ 
+ 	result_type_info()
+-		: caf::detail::abstract_uniform_type_info<result>(
++		: caf::abstract_uniform_type_info<result>(
+ 	          "broker::store::result")
+ 		{}
+ 

security/bro/files/patch-aux-broker-src-store-value_type_info.hh

@@ -0,0 +1,26 @@
+--- aux/broker/src/store/value_type_info.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/store/value_type_info.hh
+@@ -2,7 +2,7 @@
+ #define BROKER_STORE_VALUE_TYPE_INFO_HH
+ 
+ #include "broker/store/value.hh"
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ 
+@@ -12,12 +12,11 @@ namespace broker { namespace store {
+  * (de)serialization logic for type "value".
+  */
+ class value_type_info
+-        : public caf::detail::abstract_uniform_type_info<value> {
++        : public caf::abstract_uniform_type_info<value> {
+ public:
+ 
+     value_type_info()
+-		: caf::detail::abstract_uniform_type_info<value>(
+-	          "broker::store::value")
++		: caf::abstract_uniform_type_info<value>("broker::store::value")
+ 		{}
+ 
+ 	void serialize(const void* ptr, caf::serializer* sink) const override

security/bro/files/patch-aux-broker-src-subnet_type_info.hh

@@ -0,0 +1,25 @@
+--- aux/broker/src/subnet_type_info.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/subnet_type_info.hh
+@@ -2,7 +2,7 @@
+ #define BROKER_SUBNET_TYPE_INFO_HH
+ 
+ #include "broker/subnet.hh"
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ 
+@@ -12,11 +12,11 @@ namespace broker {
+  * (de)serialization logic for type "subnet".
+  */
+ class subnet_type_info
+-      : public caf::detail::abstract_uniform_type_info<subnet> {
++      : public caf::abstract_uniform_type_info<subnet> {
+ public :
+ 
+ 	subnet_type_info()
+-		: caf::detail::abstract_uniform_type_info<subnet>("broker::subnet")
++		: caf::abstract_uniform_type_info<subnet>("broker::subnet")
+ 		{}
+ 
+ 	void serialize(const void* ptr, caf::serializer* sink) const override

security/bro/files/patch-aux-broker-src-subscription.hh

@@ -0,0 +1,27 @@
+--- aux/broker/src/subscription.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/subscription.hh
+@@ -5,7 +5,8 @@
+ #include "broker/util/optional.hh"
+ #include "util/radix_tree.hh"
+ #include <caf/actor.hpp>
+-#include <caf/detail/abstract_uniform_type_info.hpp>
++#include <caf/actor_addr.hpp>
++#include <caf/abstract_uniform_type_info.hpp>
+ #include <caf/serializer.hpp>
+ #include <caf/deserializer.hpp>
+ #include <unordered_map>
+@@ -22,12 +23,11 @@ using topic_set = util::radix_tree<bool>
+  * (de)serialization logic for type "topic_set".
+  */
+ class topic_set_type_info
+-        : public caf::detail::abstract_uniform_type_info<topic_set> {
++        : public caf::abstract_uniform_type_info<topic_set> {
+ public:
+ 
+ 	topic_set_type_info()
+-		: caf::detail::abstract_uniform_type_info<topic_set>(
+-	          "broker::topic_set")
++		: caf::abstract_uniform_type_info<topic_set>("broker::topic_set")
+ 		{}
+ 
+ 	void serialize(const void* ptr, caf::serializer* sink) const override;

security/bro/files/patch-aux-broker-src-util-queue_actor.hh

@@ -0,0 +1,52 @@
+--- aux/broker/src/util/queue_actor.hh.orig	2015-09-06 19:43:53 UTC
++++ aux/broker/src/util/queue_actor.hh
+@@ -3,7 +3,7 @@
+ 
+ #include "../atoms.hh"
+ #include "flare.hh"
+-#include <caf/sb_actor.hpp>
++#include <caf/event_based_actor.hpp>
+ #include <caf/scoped_actor.hpp>
+ #include <deque>
+ 
+@@ -15,9 +15,8 @@ namespace util {
+  * a flare which signals when the queue is non-empty.  This makes it simple
+  * to integrate in to traditional event loops.
+  */
+-template <typename Pattern, typename Message>
+-class queue_actor : public caf::sb_actor<queue_actor<Pattern, Message>> {
+-friend class caf::sb_actor<queue_actor<Pattern, Message>>;
++template <typename Message>
++class queue_actor : public caf::event_based_actor {
+ 
+ public:
+ 
+@@ -29,7 +28,7 @@ public:
+ 			{
+ 			[=](want_atom)
+ 				{ return pop(); },
+-			Pattern() >> [=](Message& msg)
++			[=](Message& msg)
+ 				{
+ 				q.push_back(std::move(msg));
+ 				this->become(filled);
+@@ -46,6 +45,11 @@ public:
+ 
+ private:
+ 
++	caf::behavior make_behavior() override
++		{
++		return empty;
++		}
++
+ 	std::deque<Message> pop()
+ 		{
+ 		auto rval = std::move(q);
+@@ -58,7 +62,6 @@ private:
+ 	flare ready_flare;
+ 	caf::behavior empty;
+ 	caf::behavior filled;
+-	caf::behavior& init_state = empty;
+ 	std::deque<Message> q;
+ };
+ 

security/bro/pkg-plist

@@ -1,5 +1,4 @@
-@exec chown %%BROUSER%%:%%BROGROUP%% %D/logs
+%%BROCTL%%@exec chown %%BROUSER%%:%%BROGROUP%% %D/logs
-%%BROCTL%%@exec chown %%BROUSER%%:%%BROGROUP%% %D/share/broctl/scripts
 %%BROCTL%%@exec chown %%BROUSER%%:%%BROGROUP%% %D/spool
 %%BROCTL%%@exec chown %%BROUSER%%:%%BROGROUP%% %D/spool/tmp
 %%BROCTL%%@exec chown -R %%BROUSER%%:%%BROGROUP%% %D/spool/installed-scripts-do-not-touch
@@ -17,8 +16,53 @@ bin/bro-cut
 %%BROCTL%%@unexec if cmp -s %D/etc/node.cfg.example %D/etc/node.cfg ; then rm -f %D/etc/node.cfg; fi
 %%BROCTL%%etc/node.cfg.example
 %%BROCTL%%@exec if [ ! -f %D/etc/node.cfg ] ; then cp -p %D/etc/node.cfg.example %D/etc/node.cfg; fi
+%%BROKER%%include/broker/address.hh
+%%BROKER%%include/broker/broker.h
+%%BROKER%%include/broker/broker.hh
+%%BROKER%%include/broker/data.hh
+%%BROKER%%include/broker/endpoint.hh
+%%BROKER%%include/broker/enum_value.hh
+%%BROKER%%include/broker/incoming_connection_status.hh
+%%BROKER%%include/broker/message.hh
+%%BROKER%%include/broker/message_queue.hh
+%%BROKER%%include/broker/outgoing_connection_status.hh
+%%BROKER%%include/broker/peering.hh
+%%BROKER%%include/broker/port.hh
+%%BROKER%%include/broker/queue.hh
+%%BROKER%%include/broker/report.hh
+%%BROKER%%include/broker/store/backend.hh
+%%BROKER%%include/broker/store/clone.hh
+%%BROKER%%include/broker/store/expiration_time.hh
+%%BROKER%%include/broker/store/frontend.hh
+%%BROKER%%include/broker/store/identifier.hh
+%%BROKER%%include/broker/store/master.hh
+%%BROKER%%include/broker/store/memory_backend.hh
+%%BROKER%%include/broker/store/query.hh
+%%BROKER%%include/broker/store/response.hh
+%%BROKER%%include/broker/store/result.hh
+%%BROKER%%include/broker/store/rocksdb_backend.hh
+%%BROKER%%include/broker/store/sequence_num.hh
+%%BROKER%%include/broker/store/snapshot.hh
+%%BROKER%%include/broker/store/sqlite_backend.hh
+%%BROKER%%include/broker/store/value.hh
+%%BROKER%%include/broker/subnet.hh
+%%BROKER%%include/broker/time_duration.hh
+%%BROKER%%include/broker/time_point.hh
+%%BROKER%%include/broker/topic.hh
+%%BROKER%%include/broker/util/hash.hh
+%%BROKER%%include/broker/util/meta.hh
+%%BROKER%%include/broker/util/none.hh
+%%BROKER%%include/broker/util/operators.hh
+%%BROKER%%include/broker/util/optional.hh
+%%BROKER%%include/broker/util/variant.hh
 %%BROCTL%%lib/broctl/BroControl/__init__.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/__init__.pyc
+%%BROCTL%%lib/broctl/BroControl/brocmd.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/brocmd.pyc
+%%BROCTL%%lib/broctl/BroControl/broctl.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/broctl.pyc
+%%BROCTL%%lib/broctl/BroControl/cmdresult.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/cmdresult.pyc
 %%BROCTL%%lib/broctl/BroControl/config.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/config.pyc
 %%BROCTL%%lib/broctl/BroControl/control.py
@@ -27,6 +71,8 @@ bin/bro-cut
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/cron.pyc
 %%BROCTL%%lib/broctl/BroControl/doc.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/doc.pyc
+%%BROCTL%%lib/broctl/BroControl/events.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/events.pyc
 %%BROCTL%%lib/broctl/BroControl/execute.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/execute.pyc
 %%BROCTL%%lib/broctl/BroControl/install.py
@@ -39,8 +85,20 @@ bin/bro-cut
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/plugin.pyc
 %%BROCTL%%lib/broctl/BroControl/pluginreg.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/pluginreg.pyc
+%%BROCTL%%lib/broctl/BroControl/printdoc.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/printdoc.pyc
+%%BROCTL%%lib/broctl/BroControl/py3bro.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/py3bro.pyc
+%%BROCTL%%lib/broctl/BroControl/ssh_runner.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/ssh_runner.pyc
+%%BROCTL%%lib/broctl/BroControl/state.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/state.pyc
 %%BROCTL%%lib/broctl/BroControl/util.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/util.pyc
+%%BROCTL%%lib/broctl/BroControl/utilcurses.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/utilcurses.pyc
+%%BROCTL%%lib/broctl/BroControl/version.py
+%%BROCTL%%@unexec rm -f %D/lib/broctl/BroControl/version.pyc
 %%BROCTL%%lib/broctl/SubnetTree.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/SubnetTree.pyc
 %%BROCTL%%lib/broctl/_SubnetTree.so
@@ -52,22 +110,38 @@ bin/bro-cut
 %%BROCTL%%@unexec rm -f %D/lib/broctl/plugins/lb_pf_ring.pyc
 %%BROCTL%%lib/broctl/plugins/ps.py
 %%BROCTL%%@unexec rm -f %D/lib/broctl/plugins/ps.pyc
+%%BROKER%%lib/libbroker.so
+%%BROKER%%lib/libbroker.so.0
+%%BROKER%%lib/libbroker.so.0.4.0
+man/man1/bro-cut.1.gz
+%%BROCTL%%man/man1/trace-summary.1.gz
+man/man8/bro.8.gz
+%%BROCTL%%man/man8/broctl.8.gz
 %%DATADIR%%/base/bif/__load__.bro
 %%DATADIR%%/base/bif/analyzer.bif.bro
 %%DATADIR%%/base/bif/bloom-filter.bif.bro
 %%DATADIR%%/base/bif/bro.bif.bro
 %%DATADIR%%/base/bif/broxygen.bif.bro
 %%DATADIR%%/base/bif/cardinality-counter.bif.bro
+%%DATADIR%%/base/bif/comm.bif.bro
 %%DATADIR%%/base/bif/const.bif.bro
+%%DATADIR%%/base/bif/data.bif.bro
 %%DATADIR%%/base/bif/event.bif.bro
 %%DATADIR%%/base/bif/file_analysis.bif.bro
 %%DATADIR%%/base/bif/input.bif.bro
 %%DATADIR%%/base/bif/logging.bif.bro
+%%DATADIR%%/base/bif/messaging.bif.bro
+%%DATADIR%%/base/bif/pcap.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_ARP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_AYIYA.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_AsciiReader.ascii.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_AsciiWriter.ascii.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_BackDoor.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_BenchmarkReader.benchmark.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_BinaryReader.binary.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_BitTorrent.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_ConnSize.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_ConnSize.functions.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_DCE_RPC.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_DHCP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_DNP3.events.bif.bro
@@ -87,26 +161,37 @@ bin/bro-cut
 %%DATADIR%%/base/bif/plugins/Bro_IRC.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_Ident.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_InterConn.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_KRB.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_KRB.types.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_Login.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_Login.functions.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_MIME.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_Modbus.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_MySQL.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_NCP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_NTP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_NetBIOS.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_NetBIOS.functions.bif.bro
-%%DATADIR%%/base/bif/plugins/Bro_NetFlow.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_NoneWriter.none.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_PE.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_PIA.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_POP3.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_RADIUS.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_RDP.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_RDP.types.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_RPC.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_RawReader.raw.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_SIP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SMB.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SMTP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SMTP.functions.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SNMP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SNMP.types.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SOCKS.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_SQLiteReader.sqlite.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SSH.events.bif.bro
+%%DATADIR%%/base/bif/plugins/Bro_SSH.types.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SSL.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_SteppingStone.events.bif.bro
 %%DATADIR%%/base/bif/plugins/Bro_Syslog.events.bif.bro
@@ -122,6 +207,7 @@ bin/bro-cut
 %%DATADIR%%/base/bif/plugins/Bro_ZIP.events.bif.bro
 %%DATADIR%%/base/bif/plugins/__load__.bro
 %%DATADIR%%/base/bif/reporter.bif.bro
+%%DATADIR%%/base/bif/store.bif.bro
 %%DATADIR%%/base/bif/strings.bif.bro
 %%DATADIR%%/base/bif/top-k.bif.bro
 %%DATADIR%%/base/bif/types.bif.bro
@@ -129,12 +215,17 @@ bin/bro-cut
 %%DATADIR%%/base/files/extract/main.bro
 %%DATADIR%%/base/files/hash/__load__.bro
 %%DATADIR%%/base/files/hash/main.bro
+%%DATADIR%%/base/files/pe/__load__.bro
+%%DATADIR%%/base/files/pe/consts.bro
+%%DATADIR%%/base/files/pe/main.bro
 %%DATADIR%%/base/files/unified2/__load__.bro
 %%DATADIR%%/base/files/unified2/main.bro
 %%DATADIR%%/base/files/x509/__load__.bro
 %%DATADIR%%/base/files/x509/main.bro
 %%DATADIR%%/base/frameworks/analyzer/__load__.bro
 %%DATADIR%%/base/frameworks/analyzer/main.bro
+%%DATADIR%%/base/frameworks/broker/__load__.bro
+%%DATADIR%%/base/frameworks/broker/main.bro
 %%DATADIR%%/base/frameworks/cluster/__load__.bro
 %%DATADIR%%/base/frameworks/cluster/main.bro
 %%DATADIR%%/base/frameworks/cluster/nodes/manager.bro
@@ -149,8 +240,14 @@ bin/bro-cut
 %%DATADIR%%/base/frameworks/dpd/main.bro
 %%DATADIR%%/base/frameworks/files/__load__.bro
 %%DATADIR%%/base/frameworks/files/magic/__load__.bro
+%%DATADIR%%/base/frameworks/files/magic/archive.sig
+%%DATADIR%%/base/frameworks/files/magic/audio.sig
+%%DATADIR%%/base/frameworks/files/magic/font.sig
 %%DATADIR%%/base/frameworks/files/magic/general.sig
+%%DATADIR%%/base/frameworks/files/magic/image.sig
 %%DATADIR%%/base/frameworks/files/magic/libmagic.sig
+%%DATADIR%%/base/frameworks/files/magic/msoffice.sig
+%%DATADIR%%/base/frameworks/files/magic/video.sig
 %%DATADIR%%/base/frameworks/files/main.bro
 %%DATADIR%%/base/frameworks/input/__load__.bro
 %%DATADIR%%/base/frameworks/input/main.bro
@@ -169,8 +266,6 @@ bin/bro-cut
 %%DATADIR%%/base/frameworks/logging/postprocessors/scp.bro
 %%DATADIR%%/base/frameworks/logging/postprocessors/sftp.bro
 %%DATADIR%%/base/frameworks/logging/writers/ascii.bro
-%%DATADIR%%/base/frameworks/logging/writers/dataseries.bro
-%%DATADIR%%/base/frameworks/logging/writers/elasticsearch.bro
 %%DATADIR%%/base/frameworks/logging/writers/none.bro
 %%DATADIR%%/base/frameworks/logging/writers/sqlite.bro
 %%DATADIR%%/base/frameworks/notice/__load__.bro
@@ -223,6 +318,7 @@ bin/bro-cut
 %%DATADIR%%/base/protocols/conn/inactivity.bro
 %%DATADIR%%/base/protocols/conn/main.bro
 %%DATADIR%%/base/protocols/conn/polling.bro
+%%DATADIR%%/base/protocols/conn/thresholds.bro
 %%DATADIR%%/base/protocols/dhcp/__load__.bro
 %%DATADIR%%/base/protocols/dhcp/consts.bro
 %%DATADIR%%/base/protocols/dhcp/dpd.sig
@@ -254,14 +350,29 @@ bin/bro-cut
 %%DATADIR%%/base/protocols/irc/dpd.sig
 %%DATADIR%%/base/protocols/irc/files.bro
 %%DATADIR%%/base/protocols/irc/main.bro
+%%DATADIR%%/base/protocols/krb/__load__.bro
+%%DATADIR%%/base/protocols/krb/consts.bro
+%%DATADIR%%/base/protocols/krb/dpd.sig
+%%DATADIR%%/base/protocols/krb/files.bro
+%%DATADIR%%/base/protocols/krb/main.bro
 %%DATADIR%%/base/protocols/modbus/__load__.bro
 %%DATADIR%%/base/protocols/modbus/consts.bro
 %%DATADIR%%/base/protocols/modbus/main.bro
+%%DATADIR%%/base/protocols/mysql/__load__.bro
+%%DATADIR%%/base/protocols/mysql/consts.bro
+%%DATADIR%%/base/protocols/mysql/main.bro
 %%DATADIR%%/base/protocols/pop3/__load__.bro
 %%DATADIR%%/base/protocols/pop3/dpd.sig
 %%DATADIR%%/base/protocols/radius/__load__.bro
 %%DATADIR%%/base/protocols/radius/consts.bro
 %%DATADIR%%/base/protocols/radius/main.bro
+%%DATADIR%%/base/protocols/rdp/__load__.bro
+%%DATADIR%%/base/protocols/rdp/consts.bro
+%%DATADIR%%/base/protocols/rdp/dpd.sig
+%%DATADIR%%/base/protocols/rdp/main.bro
+%%DATADIR%%/base/protocols/sip/__load__.bro
+%%DATADIR%%/base/protocols/sip/dpd.sig
+%%DATADIR%%/base/protocols/sip/main.bro
 %%DATADIR%%/base/protocols/smtp/__load__.bro
 %%DATADIR%%/base/protocols/smtp/dpd.sig
 %%DATADIR%%/base/protocols/smtp/entities.bro
@@ -317,6 +428,7 @@ bin/bro-cut
 %%DATADIR%%/policy/frameworks/dpd/detect-protocols.bro
 %%DATADIR%%/policy/frameworks/dpd/packet-segment-logging.bro
 %%DATADIR%%/policy/frameworks/files/detect-MHR.bro
+%%DATADIR%%/policy/frameworks/files/extract-all-files.bro
 %%DATADIR%%/policy/frameworks/files/hash-all-files.bro
 %%DATADIR%%/policy/frameworks/intel/do_notice.bro
 %%DATADIR%%/policy/frameworks/intel/seen/__load__.bro
@@ -326,6 +438,7 @@ bin/bro-cut
 %%DATADIR%%/policy/frameworks/intel/seen/file-names.bro
 %%DATADIR%%/policy/frameworks/intel/seen/http-headers.bro
 %%DATADIR%%/policy/frameworks/intel/seen/http-url.bro
+%%DATADIR%%/policy/frameworks/intel/seen/pubkey-hashes.bro
 %%DATADIR%%/policy/frameworks/intel/seen/smtp-url-extraction.bro
 %%DATADIR%%/policy/frameworks/intel/seen/smtp.bro
 %%DATADIR%%/policy/frameworks/intel/seen/ssl.bro
@@ -335,6 +448,7 @@ bin/bro-cut
 %%DATADIR%%/policy/frameworks/signatures/detect-windows-shells.sig
 %%DATADIR%%/policy/frameworks/software/version-changes.bro
 %%DATADIR%%/policy/frameworks/software/vulnerable.bro
+%%DATADIR%%/policy/frameworks/software/windows-version-detection.bro
 %%DATADIR%%/policy/integration/barnyard2/__load__.bro
 %%DATADIR%%/policy/integration/barnyard2/main.bro
 %%DATADIR%%/policy/integration/barnyard2/types.bro
@@ -380,6 +494,8 @@ bin/bro-cut
 %%DATADIR%%/policy/protocols/http/var-extraction-uri.bro
 %%DATADIR%%/policy/protocols/modbus/known-masters-slaves.bro
 %%DATADIR%%/policy/protocols/modbus/track-memmap.bro
+%%DATADIR%%/policy/protocols/mysql/software.bro
+%%DATADIR%%/policy/protocols/rdp/indicate_ssl.bro
 %%DATADIR%%/policy/protocols/smtp/blocklists.bro
 %%DATADIR%%/policy/protocols/smtp/detect-suspicious-orig.bro
 %%DATADIR%%/policy/protocols/smtp/entities-excerpt.bro
@@ -403,7 +519,6 @@ bin/bro-cut
 %%DATADIR%%/policy/tuning/defaults/packet-fragments.bro
 %%DATADIR%%/policy/tuning/defaults/warnings.bro
 %%DATADIR%%/policy/tuning/json-logs.bro
-%%DATADIR%%/policy/tuning/logs-to-elasticsearch.bro
 %%DATADIR%%/policy/tuning/track-all-assets.bro
 %%DATADIR%%/site/local-manager.bro
 %%DATADIR%%/site/local-proxy.bro
@@ -414,27 +529,19 @@ bin/bro-cut
 %%BROCTL%%%%DATADIR%%ctl/scripts/cflow-stats
 %%BROCTL%%%%DATADIR%%ctl/scripts/check-config
 %%BROCTL%%%%DATADIR%%ctl/scripts/crash-diag
-%%BROCTL%%%%DATADIR%%ctl/scripts/create-link-for-log
 %%BROCTL%%%%DATADIR%%ctl/scripts/delete-log
 %%BROCTL%%%%DATADIR%%ctl/scripts/expire-logs
-%%BROCTL%%%%DATADIR%%ctl/scripts/helpers/cat-file
 %%BROCTL%%%%DATADIR%%ctl/scripts/helpers/check-pid
 %%BROCTL%%%%DATADIR%%ctl/scripts/helpers/df
-%%BROCTL%%%%DATADIR%%ctl/scripts/helpers/exists
+%%BROCTL%%%%DATADIR%%ctl/scripts/helpers/first-line
-%%BROCTL%%%%DATADIR%%ctl/scripts/helpers/gdb-attach
 %%BROCTL%%%%DATADIR%%ctl/scripts/helpers/get-childs
-%%BROCTL%%%%DATADIR%%ctl/scripts/helpers/is-dir
-%%BROCTL%%%%DATADIR%%ctl/scripts/helpers/rmdir
-%%BROCTL%%%%DATADIR%%ctl/scripts/helpers/run-cmd
 %%BROCTL%%%%DATADIR%%ctl/scripts/helpers/start
 %%BROCTL%%%%DATADIR%%ctl/scripts/helpers/stop
 %%BROCTL%%%%DATADIR%%ctl/scripts/helpers/to-bytes.awk
 %%BROCTL%%%%DATADIR%%ctl/scripts/helpers/top
-%%BROCTL%%%%DATADIR%%ctl/scripts/local-interfaces
 %%BROCTL%%%%DATADIR%%ctl/scripts/make-archive-name
 %%BROCTL%%%%DATADIR%%ctl/scripts/post-terminate
 %%BROCTL%%%%DATADIR%%ctl/scripts/postprocessors/summarize-connections
-%%BROCTL%%%%DATADIR%%ctl/scripts/remove-link-for-log
 %%BROCTL%%%%DATADIR%%ctl/scripts/run-bro
 %%BROCTL%%%%DATADIR%%ctl/scripts/run-bro-on-trace
 %%BROCTL%%%%DATADIR%%ctl/scripts/send-mail
@@ -451,6 +558,7 @@ bin/bro-cut
 %%BROCTL%%@unexec rm -f %D/spool/installed-scripts-do-not-touch/site/local-proxy.bro
 %%BROCTL%%@unexec rm -f %D/spool/installed-scripts-do-not-touch/site/local-worker.bro
 %%BROCTL%%@unexec rm -f %D/spool/installed-scripts-do-not-touch/site/local.bro
+%%BROCTL%%@unexec rm -f %D/spool/state.db
 %%BROCTL%%@dir spool/tmp
 %%BROCTL%%@dir spool/installed-scripts-do-not-touch/site
 %%BROCTL%%@dir spool/installed-scripts-do-not-touch/auto
@@ -466,6 +574,8 @@ bin/bro-cut
 @dir %%DATADIR%%/policy/protocols/ssl
 @dir %%DATADIR%%/policy/protocols/ssh
 @dir %%DATADIR%%/policy/protocols/smtp
+@dir %%DATADIR%%/policy/protocols/rdp
+@dir %%DATADIR%%/policy/protocols/mysql
 @dir %%DATADIR%%/policy/protocols/modbus
 @dir %%DATADIR%%/policy/protocols/http
 @dir %%DATADIR%%/policy/protocols/ftp
@@ -501,9 +611,13 @@ bin/bro-cut
 @dir %%DATADIR%%/base/protocols/socks
 @dir %%DATADIR%%/base/protocols/snmp
 @dir %%DATADIR%%/base/protocols/smtp
+@dir %%DATADIR%%/base/protocols/sip
+@dir %%DATADIR%%/base/protocols/rdp
 @dir %%DATADIR%%/base/protocols/radius
 @dir %%DATADIR%%/base/protocols/pop3
+@dir %%DATADIR%%/base/protocols/mysql
 @dir %%DATADIR%%/base/protocols/modbus
+@dir %%DATADIR%%/base/protocols/krb
 @dir %%DATADIR%%/base/protocols/irc
 @dir %%DATADIR%%/base/protocols/http
 @dir %%DATADIR%%/base/protocols/ftp
@@ -536,10 +650,12 @@ bin/bro-cut
 @dir %%DATADIR%%/base/frameworks/communication
 @dir %%DATADIR%%/base/frameworks/cluster/nodes
 @dir %%DATADIR%%/base/frameworks/cluster
+@dir %%DATADIR%%/base/frameworks/broker
 @dir %%DATADIR%%/base/frameworks/analyzer
 @dir %%DATADIR%%/base/frameworks
 @dir %%DATADIR%%/base/files/x509
 @dir %%DATADIR%%/base/files/unified2
+@dir %%DATADIR%%/base/files/pe
 @dir %%DATADIR%%/base/files/hash
 @dir %%DATADIR%%/base/files/extract
 @dir %%DATADIR%%/base/files
@@ -548,11 +664,19 @@ bin/bro-cut
 @dir %%DATADIR%%/base
 @dir %%DATADIR%%
 %%CLEANUP_PREFIX%%@dir share
-@dir logs
+%%CLEANUP_PREFIX%%%%BROKER%%@dir man/man8
+%%CLEANUP_PREFIX%%%%BROKER%%@dir man/man1
+%%CLEANUP_PREFIX%%%%BROKER%%@dir man
+%%BROCTL%%@dir logs
 %%BROCTL%%@dir lib/broctl/plugins
 %%BROCTL%%@dir lib/broctl/BroControl
 %%BROCTL%%@dir lib/broctl
+@dir lib/bro/plugins
 %%CLEANUP_PREFIX%%@dir lib
+%%CLEANUP_PREFIX%%%%BROKER%%@dir include/broker/util
+%%CLEANUP_PREFIX%%%%BROKER%%@dir include/broker/store
+%%CLEANUP_PREFIX%%%%BROKER%%@dir include/broker
+%%CLEANUP_PREFIX%%@dir include
 %%CLEANUP_PREFIX%%@dir etc
 %%CLEANUP_PREFIX%%@dir bin
 %%BROCTL%%@exec su -fm %%BROUSER%% -c '%D/bin/broctl install'