[Bro-Dev] pattern values and "||"/"&&" operators
Johanna Amann
johanna at icir.org
Thu Apr 26 14:32:11 PDT 2018
On 26 Apr 2018, at 14:04, Vern Paxson wrote:
> In implementing bitwise operations for counts (now pretty much done!),
> I found that Bro's internals actually support "||" and "&&" operators
> for
> patterns:
>
> p1 || p2 returns a pattern that matches either p1 or p2
> p1 && p2 returns a pattern that matches p1 followed by p2
>
> (Note that this second is not obvious. One might instead expect it to
> return a pattern that matches only if both p1 and p2 match, where the
> two
> could overlap.)
>
> This doesn't appear to be documented anywhere. I discussed it with
> Robin
> and we both agree that this seems weird and likely not used anywhere.
> Therefore we're thinking we should deprecate it and eventually remove
> it.
Sounds fine to me - I totally was not aware of this. Though having the
functionality of the former available in some form would be kind of
nice-I have a few scripts where I would have used that.
Johanna
More information about the bro-dev
mailing list