[Bro-Dev] Null / None / undef in Bro policy scripts

Seth Hall seth at icir.org
Tue Dec 7 17:09:17 PST 2010


On Dec 7, 2010, at 5:33 PM, Gregor Maier wrote:

> is there a NULL (or nil, None, undef) for the policy layer for record
> types? I would like to have an event, with a record type in its
> parameter list. But the record can be NULL....
> How can I do this?

There isn't a way to specify a missing record, but you could do a record with all optional and default fields.  Or maybe even something like this...

type whatever: record {
	empty: bool &default=T;
	....rest of data...
};

You could test for the empty key being set to T and when you fill out the record in your analyzer you would make sure to set the empty value to F.


More information about the bro-dev mailing list