[Bro-Dev] Null / None / undef in Bro policy scripts
Seth Hall
seth at icir.org
Tue Dec 7 17:09:17 PST 2010
On Dec 7, 2010, at 5:33 PM, Gregor Maier wrote:
> is there a NULL (or nil, None, undef) for the policy layer for record
> types? I would like to have an event, with a record type in its
> parameter list. But the record can be NULL....
> How can I do this?
There isn't a way to specify a missing record, but you could do a record with all optional and default fields. Or maybe even something like this...
type whatever: record {
empty: bool &default=T;
....rest of data...
};
You could test for the empty key being set to T and when you fill out the record in your analyzer you would make sure to set the empty value to F.
More information about the bro-dev
mailing list