[Bro-Dev] #375: Extending record type fields
Bro Tracker
bro at tracker.icir.org
Fri Feb 4 14:24:51 PST 2011
#375: Extending record type fields
------------------------------+---------------------
Reporter: seth | Owner:
Type: Feature Request | Status: new
Priority: Normal | Milestone: Bro1.6
Component: Bro | Version:
Resolution: | Keywords: logging
------------------------------+---------------------
Comment (by gregor):
Well, by convention the bif might only ever be called if the appropriate
extension is loaded (maybe it's only called from the .bro file that adds
the extension). Then if another policy script does the same, there can be
problems.
But I do agree that these are probably rare cases and that bif or C++
developers should lookup the fieldname instead of assuming its position
for any extension fields. However, we probably can't force that and it may
generate bugs in user-written Bif's that might be hard to track down.
I'm not against this extension, I just wanted to raise awareness of
potential problems.
--
Ticket URL: <http://tracker.icir.org/bro/ticket/375#comment:4>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list