[Bro-Dev] BiF parsing index types

Robin Sommer robin at icir.org
Fri May 13 17:46:10 PDT 2011


On Thu, May 12, 2011 at 12:49 -0700, you wrote:

> Type definitions in bro can be quite complex and one would have to
> completely duplicate that in bif.

Does bifcf really need to parse the type fully? Could it just treat
more complex types as opaque strings and carry them through into the
output?

> I could just specify the record in the BiF. Instead I have to specify
> the record in a bro file and put a simple "type foo: record;" in the
> BiF. Otherwise I would have had to copy all record-type-definition syntax.

Likewise, would some simpler parsing rule work here that doesn't
understand all the pieces going into the record? Haven't really
thought this through admittedly.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org


More information about the bro-dev mailing list