[Bro-Dev] #560: Child analyzer Init() problem

[Bro Tracker]

#560: Child analyzer Init() problem
---------------------+------------------------
 Reporter:  gregor   |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:  Bro1.7
Component:  Bro      |    Version:  git/master
 Keywords:           |
---------------------+------------------------
 {{{
 #!rst

 I think there is an inherent problem in the way analyzers and child
 analyzers are initialized. If analyzers are added by
 BuildInitialAnalyzerTree() they are not initialized at first but in a
 batch by calling::

     root->Init();
     root->InitChildren();

 If an analyzer wants to add a child in its Init(), the parent doesn't know
 whether it needs to init this child or not. If the parent was added by
 ``BuildInitialAnalyzerTree()``, it *must not* ``Init()`` the child,
 because ``BuildInitialAnalyzerTree()`` will do it. OTOH, if the parent was
 added dynamically, e.g., by DPD signatures, then it *must* ``Init()`` the
 child.

 What was the reason for ``BuildInitialAnalyzerTree()`` to defer
 initialization of the tree until the end of the function?  Initializing
 when they are added would solve the problem but I guess there was a good
 reason to do it this way.





 }}}

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/560>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker