42a43,160
> // The following are declarations needed for the modp_burl string decoding
> // functions. They were cribbed from the stringencoders-v3.7.0 source tree.
> // syc 1/20/09
> 
> /**
>  * \file
>  * <pre>
>  * BFASTURL.c High performance URL encoder/decoder
>  * http://code.google.com/p/stringencoders/
>  *
>  * Copyright &copy; 2006,2007  Nick Galbreath -- nickg [at] modp [dot] com
>  * All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions are
>  * met:
>  *
>  *   Redistributions of source code must retain the above copyright
>  *   notice, this list of conditions and the following disclaimer.
>  *
>  *   Redistributions in binary form must reproduce the above copyright
>  *   notice, this list of conditions and the following disclaimer in the
>  *   documentation and/or other materials provided with the distribution.
>  *
>  *   Neither the name of the modp.com nor the names of its
>  *   contributors may be used to endorse or promote products derived from
>  *   this software without specific prior written permission.
>  *
>  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
>  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
>  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
>  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
>  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
>  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
>  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
>  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
>  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>  *
>  * This is the standard "new" BSD license:
>  * http://www.opensource.org/licenses/bsd-license.php
>  * </PRE>
>  */
> 
> static const uint32_t gsHexDecodeMap[256] = {
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
>   0,   1,   2,   3,   4,   5,   6,   7,   8,   9, 256, 256,
> 256, 256, 256, 256, 256,  10,  11,  12,  13,  14,  15, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256,  10,  11,  12,  13,  14,  15, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
>  256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256,
> 256, 256, 256, 256
> };
> 
> 
> int modp_burl_decode(char* dest, const char* s, int len)
> {
>     uint32_t d = 0; // used for decoding %XX
>     const uint8_t* src = (const uint8_t*) s;
>     const char* deststart = dest;
>     const uint8_t* srcend = (const uint8_t*)(src + len);
>     const uint8_t* srcendloop = (const uint8_t*)(srcend - 2);
> 
>     while (src < srcendloop) {
>         switch (*src) {
>         case '+':
>             *dest++ = ' ';
>             src++;
>             break;
>         case '%':
>             d = (gsHexDecodeMap[(uint32_t)(*(src + 1))] << 4) |
>                 gsHexDecodeMap[(uint32_t)(*(src + 2))];
>             if (d < 256) { // if one of the hex chars is bad,  d >= 256
>                 *dest = (char) d;
>                 dest++;
>                 src += 3;
>             } else {
>                 *dest++ = '%';
>                 src++;
>             }
>             break;
>         default:
>             *dest++ = *src++;
>         }
>     }
> 
>     // handle last two chars
>     // dont decode "%XX"
>     while (src < srcend) {
>         switch (*src) {
>         case '+':
>             *dest++ = ' ';
>             src++;
>             break;
>         default:
>             *dest++ = *src++;
>         }
>     }
> 
>     *dest = '\0';
>     return dest - deststart; // compute "strlen" of dest.
> }
56c174
< 		"	string, int, count, double, bool, time, \n"
---
> 		"	string, urlstring, int, count, double, bool, time, \n"
59c177,179
< 		"	net=10.10.10.0 and subnet=10.0.0.0/8\n";
---
> 		"	net=10.10.10.0, subnet=10.0.0.0/8\n"
> 		"	urlstring is a url encoded string type - use this when\n"
> 		"	whitespace can be found in the strings\n";
231a352,354
> 	char *urlstr = NULL;
> 	int urlstrsz = 0;
> 
239c362
< 	host = default_host;
---
> 	host = default_host + ":" + default_port;
281,282c404,409
< 	if (argc == 1)
< 		host = argv[0];
---
> 	if (argc == 1) {
> 	  host = argv[0];
> 	  if (host.find(':') == string::npos)
> 	    host += ":" + default_port;
> 	}
> 
361a489,509
> 				else if (tkn_type == "urlstring")
> 				        {
> 					BroString arg;
> 					bro_string_init(&arg);
> 					int sz= strlen(tkn_data.c_str()) + 1;
> 					if ( sz > urlstrsz) {
> 					    if (urlstr)
> 					        free( urlstr);
> 					    urlstr = (char *)malloc( sz);
> 					    if (urlstr == NULL) {
> 					        fprintf( stderr,"Could not allocate %d bytes for url conversion buffer\n",sz);
> 						return(1);
> 					    }
> 					    urlstrsz = sz;
> 					}
> 					modp_burl_decode(urlstr,tkn_data.c_str(),strlen(tkn_data.c_str()));
> 					bro_string_set(&arg,urlstr);
> 					bro_event_add_val(ev, BRO_TYPE_STRING, NULL, &arg);
> 					bro_string_cleanup(&arg);
> 					}
>