[Bro-Dev] Config Framework Feedback

Hosom, Stephen M hosom at battelle.org
Tue Oct 30 11:09:21 PDT 2018


I bumped into a limitation that was a little frustrating to work around with the config framework.


It is inconvenient that values stored in files read by adding to Config::config_files are not available within the bro_init event. After reviewing how the Config framework works, I understand why this is the case, but it means that if you want to use configuration values on startup, you're not guaranteed to be working with the anticipated value.


I think the introduction of an event that ensures that configuration files have been read by the time that the event fires might be worthwhile. I was wondering if anyone had any thoughts on how to resolve/work-around this issue.


known.dat:


Known::KnownServers     10.230.21.220,10.230.21.221

try-config.bro:


module Known;

redef Config::config_files += {"Known.dat"};

export {
    option KnownServers: set[addr] = set();
}

event bro_init() {
        print KnownServers;
}

event bro_done() {
        print KnownServers;
}


======= output =======


bro -r stream-1.pcap ./try-config.bro

{


}

{

10.230.21.220,

10.230.21.221

}


Thanks,

Stephen



More information about the bro-dev mailing list