[Bro-Dev] pattern values and "||"/"&&" operators

Johanna Amann johanna at icir.org
Thu Apr 26 14:32:11 PDT 2018



On 26 Apr 2018, at 14:04, Vern Paxson wrote:

> In implementing bitwise operations for counts (now pretty much done!),
> I found that Bro's internals actually support "||" and "&&" operators 
> for
> patterns:
>
> 	p1 || p2	returns a pattern that matches either p1 or p2
> 	p1 && p2	returns a pattern that matches p1 followed by p2
>
> (Note that this second is not obvious.  One might instead expect it to
> return a pattern that matches only if both p1 and p2 match, where the 
> two
> could overlap.)
>
> This doesn't appear to be documented anywhere.  I discussed it with 
> Robin
> and we both agree that this seems weird and likely not used anywhere.
> Therefore we're thinking we should deprecate it and eventually remove 
> it.

Sounds fine to me - I totally was not aware of this. Though having the 
functionality of the former available in some form would be kind of 
nice-I have a few scripts where I would have used that.

Johanna


More information about the bro-dev mailing list