[Bro-Dev] #606: broccoli and connection records

Bro Tracker bro at tracker.bro-ids.org
Thu Dec 1 11:26:18 PST 2011


#606: broccoli and connection records
-----------------------+----------------------
  Reporter:  seth      |      Owner:  kreibich
      Type:  Problem   |     Status:  accepted
  Priority:  Normal    |  Milestone:
 Component:  Broccoli  |    Version:
Resolution:            |   Keywords:
-----------------------+----------------------

Comment (by kreibich):

 Yeah, check out commit bc797f1. Basically, due to the fact that nowadays
 the connection record pulls in a whole bunch of stuff via redefs,
 Broccoli's lack for certain types caused a bunch of problems. I added
 enum, vector, and file types.

 We have one problem remaining: attributes with expressions, such as
 "&default=0", which would in principle require Broccoli to support parsing
 the whole expression hierarchy. That makes little sense, so we've added a
 capability bit that Broccoli now always sends upon handshake, and Bro will
 subsequently (once Robin tweaks the code) simply not send problematic
 objects to Broccoli peers.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/606#comment:4>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list