[Bro-Dev] pattern values and "||"/"&&" operators

Vern Paxson vern at icir.org
Thu Apr 26 14:04:23 PDT 2018


In implementing bitwise operations for counts (now pretty much done!),
I found that Bro's internals actually support "||" and "&&" operators for
patterns:

	p1 || p2	returns a pattern that matches either p1 or p2
	p1 && p2	returns a pattern that matches p1 followed by p2

(Note that this second is not obvious.  One might instead expect it to
return a pattern that matches only if both p1 and p2 match, where the two
could overlap.)

This doesn't appear to be documented anywhere.  I discussed it with Robin
and we both agree that this seems weird and likely not used anywhere.
Therefore we're thinking we should deprecate it and eventually remove it.

Anyone think otherwise?

		Vern


More information about the bro-dev mailing list