[Bro-Dev] #375: Extending record type fields

Bro Tracker bro at tracker.icir.org
Fri Feb 4 14:24:51 PST 2011


#375: Extending record type fields
------------------------------+---------------------
  Reporter:  seth             |      Owner:
      Type:  Feature Request  |     Status:  new
  Priority:  Normal           |  Milestone:  Bro1.6
 Component:  Bro              |    Version:
Resolution:                   |   Keywords:  logging
------------------------------+---------------------

Comment (by gregor):

 Well, by convention the bif might only ever be called if the appropriate
 extension is loaded (maybe it's only called from the .bro file that adds
 the extension). Then if another policy script does the same, there can be
 problems.

 But I do agree that these are probably rare cases and that bif or C++
 developers should lookup the fieldname instead of assuming its position
 for any extension fields. However, we probably can't force that and it may
 generate bugs in user-written Bif's that might be hard to track down.

 I'm not against this extension, I just wanted to raise awareness of
 potential problems.

-- 
Ticket URL: <http://tracker.icir.org/bro/ticket/375#comment:4>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list