[Bro-Dev] set and vector operators

[Robin Sommer]

On Wed, Apr 25, 2018 at 10:40 -0700, you wrote:

> 	s1 + s2		Set union (for sets of the same type, of course)
> 	s1 || s2	Set union

(What's the difference between the two? Or do you mean either one or
the other?)

Like Justin, I was also thinking "|" and "&" might be more intuitive.
"||"/"&&" is really typically associated with boolean contexts, and
other languages mgiht also coerce set operands into booleans in such a
context, so that, e.g., "s1 || s2" evaluates to true if either is
non-empty. 

I see the problem with the parser but maybe adding keywords is the way
to go.

> 	s += e		Add the element 'e' to set 's'
> 				(same as the current "add s[e]")
> 	s -= e		Remove the 'e' element from 's', if present
> 				(same as the current "delete s[e]")

I'd skip these. I don't think we should add an additional set of
operators for things that Bro already supports, that's seems confusing
to me (like Perl :)

> 	s1 += s2	Same as "s1 = s1 + s2"

(Or s1 |= s2 if we pick "|" for union.)

> 	v += e		Append the element 'e' to the vector 'v'

That's probably the most requested Bro operator ever! :)

> 	v += s		Append the elements of 's' to the vector 'v',
> 				with the order not being defined

This one I'm unsure about. The point about the order being undefined
seems odd. If I don't care about order, wouldn't I stay with a set?

Robin

-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin