[Bro] Side effects on record fields when triggering events

[Christian Kreibich]

On Tue, 2005-08-30 at 21:47 -0700, Vern Paxson wrote:
> > Okay Chema and I tracked it down to the reference counting that is going
> > on in the core
> 
> Exactly.  Aggregates in Bro are passed as shallow copiess, not deep copies.
> There are times when it would be handy to have an operator to specify
> deep-copy semantics.  I share your concern at the counter-intuitive behavior
> that shallow-copy semantics can provide, but blanket deep-copy can be very
> expensive, and needlessly so in many cases.

Yeah I agree. It's also not too big a big deal if you have the way it
works in mind while writing policy code. I think I'll grow your patch
queue with some documentation. :)

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org