[Bro-Dev] Updating / Accessing ConnVal from child analyzers

[Robin Sommer]

On Fri, Dec 10, 2010 at 10:58 -0800, you wrote:

>   UpdateConnVal (RecordVal *connval,
>          RecordVal *orig_endp, RecordVal *resp_endp)

I can see passing the fill conn_val in, that would give more
flexibility at not much cost. But:

> (note that the endpoint val would also be accessible by extracting them
> from the connval, but I think this is easier).

... not sure about this: passing them in seems redundant, and it's
not much work to get the fields, so I'd just do the connval.

>     foo: conn_addl &optional;
 
> type foo_addl: record {
>    bar: string &optional;
> }

I don't see much benefit with this, given that one will still have
to adapt foo_addl when an analyzer needs to add something. It also
creates another structure that mixes information from different
analyzers (which "connection" already does). 

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org