[Bro-Dev] Configurable &write_expire interval

[Robin Sommer]

Sorry for being late to the party here. Your examples did actually
help, I'm seeing now that the current behavior really doesn't seem
right:

> const exp_val = 5min &redef;
> data: table[addr] of string &write_expire=exp_val;
> 
> # user script:
> redef exp_val = 20min; # has no effect

I'd call this a bug actually. Redefs are supposed to take effect
before anything else, so having the timeout use the original value
here seems quite wrong.

My immediate thought (without looking at the code) would be delaying
evaluating the expression until the value is needed for the first
time. At that point, the redef will have taken effect, so we should be
fine. Essentially, we'd cache the evaluated value for the future once
we have it.

Serialization is an interesting question though. I believe there'd be
nothing wrong with simply serializing the expression itself here
(rather than its value). When deserializing, we'd restore the
expression and make sure the cache value remains unset, so that on
first use it will get evaluated.

In principle, we could even go further and allow a non-constant
expression for the timeout that would get evaluated every time. My
main concern there would be performance, although I'm not sure if that
would actually cause much overhead in the still most common case of a
constant (i.e., for existing scripts).

Robin

-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin