[Bro-Dev] [JIRA] (BIT-1504) The facility to serialize tables to a log
Aaron Eppert (JIRA)
jira at bro-tracker.atlassian.net
Thu Nov 5 12:53:00 PST 2015
Aaron Eppert created BIT-1504:
---------------------------------
Summary: The facility to serialize tables to a log
Key: BIT-1504
URL: https://bro-tracker.atlassian.net/browse/BIT-1504
Project: Bro Issue Tracker
Issue Type: New Feature
Components: Bro
Reporter: Aaron Eppert
Priority: High
```@load base/protocols/http/main
@load base/protocols/http/utils
module HTTP;
redef record Info += {
cookies: table[string] of string &optional &log;
};
event http_header(c: connection, is_orig: bool, name: string, value: string)
{
if ( is_orig && name == "COOKIE" ) {
if ( ! c$http?$cookies ) {
c$http$cookies = table();
}
local cookie_vec = split_string(value, /;[[:blank:]]*/);
for (cookie in cookie_vec) {
local kv = split_string(value, /=/);
if (|kv| == 2) {
c$http$cookies[kv[0]] = kv[1];
}
}
}
}
```
Simple example. The ability to serialize the above to a log file, given it uses simple string indices and values would seem to be straight forward per looking at the Ascii and JSON writers, which appear to support TYPE_TABLE natively. I spent some time looking at how to implement this at the layers above, but the (!t->IsSet()) in SerialTypes.cc's Value::IsCompatibleType(...) is an obvious blocker and I ran out of time to deduce the rest.
I would assume I am not alone in this want as it would make proper downstream referencing of the resulting KV pairs from the table especially easy to navigate. This is, again, very much the case when using the JSON writer given it should natively serialize into very easily usable KV pair notation.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-08-005#70107)
More information about the bro-dev
mailing list