[Bro-Dev] switch/case type recognition

Jon Siwek jsiwek at corelight.com
Tue Sep 11 07:34:13 PDT 2018


On Tue, Sep 11, 2018 at 5:42 AM Matthias Vallentin <vallentin at icir.org> wrote:

> I am aware that this is a somewhat pathological case, because 'case type
> any' is probably equivalent to the 'default' case.

A 'vector of any' also qualifies as an 'any', so while the error
message of "duplicate case label" could possibly be improved, I think
it's still correct in that it is meant to prevent an ambiguous case
match.  In your example, if you did pass in a vector to that function,
it could choose either the 'any' case or the 'vector of any' case.
One might have the expectation that it chooses the first case that
matches in top-down order, however that might conflict with other
expectations that switch statements can be implemented via hash table
lookup and require unambiguous cases.  In Bro, regular 'case' is
currently a hash table lookup, while actually 'case type' is a linear
search, but that seems to be just implementation detail and not a
conscious decision that can be relied on to allow ordered-case-type
matching.

- Jon


More information about the bro-dev mailing list