[Bro-Dev] changing Notice::policy mechanism

Vern Paxson vern at icir.org
Mon Nov 5 09:13:08 PST 2012

> I think the construct we need to solve the problem already exists purely in the script-layer:
>     type TriggerFunc: function(n: Notice::Info): bool;
>     global Notice::policy: vector of set[TriggerFunc];

That doesn't have the attribute that I think we likely want, namely an
explicit "switch" on the particular notice type.

Sepaking of which, maybe we don't want an exact split-case-by-case but
rather something a bit broader.  Here I'm thinking of policies that I'd
like to apply to any Notice of n different types; it's important to not
have to replicate that code, but instead just list the n types and the
associated predicate.


More information about the bro-dev mailing list