[Bro-Dev] consistency checking for attributes

Vern Paxson vern at corelight.com
Wed Oct 31 11:17:26 PDT 2018


> To be honest I'm not even sure if the behavior
> is defined right now, i.e. if the later value will overwrite the first one.

I don't think it's defined.  Looking at the code, the later one will
indeed overwrite the first one.

> Do you want to error out when two &defaults are found or overwrite the
> first with the second one?

My thinking is that listing them together should be an error.  I don't
see why it would be legitimate for this to occur, and it seems like a
mistake that could be made if there's a lengthy list of attributes.

		Vern


More information about the bro-dev mailing list