[Bro-Dev] #560: Child analyzer Init() problem

Bro Tracker bro at tracker.bro-ids.org
Wed Aug 17 09:07:28 PDT 2011

#560: Child analyzer Init() problem
 Reporter:  gregor   |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:  Bro1.7
Component:  Bro      |    Version:  git/master
 Keywords:           |

 I think there is an inherent problem in the way analyzers and child
 analyzers are initialized. If analyzers are added by
 BuildInitialAnalyzerTree() they are not initialized at first but in a
 batch by calling::


 If an analyzer wants to add a child in its Init(), the parent doesn't know
 whether it needs to init this child or not. If the parent was added by
 ``BuildInitialAnalyzerTree()``, it *must not* ``Init()`` the child,
 because ``BuildInitialAnalyzerTree()`` will do it. OTOH, if the parent was
 added dynamically, e.g., by DPD signatures, then it *must* ``Init()`` the

 What was the reason for ``BuildInitialAnalyzerTree()`` to defer
 initialization of the tree until the end of the function?  Initializing
 when they are added would solve the problem but I guess there was a good
 reason to do it this way.


Ticket URL: <http://tracker.bro-ids.org/bro/ticket/560>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list