[Bro] Question about Controller Framework

Siwek, Jonathan Luke jsiwek at illinois.edu
Fri Feb 28 07:49:35 PST 2014


On Feb 27, 2014, at 5:15 PM, Alexander Tsankov <antsankov at gmail.com> wrote:

> Sounds great! I’m playing around with the global_ids() function, but I’m having the problem of getting too much information. My goal is to only identify global variables that are created in the script, but I am getting internal global variables that I never actually created. 

> I assume that there must be some table for this, otherwise BRO wouldn’t known when to spit back an error when you try to define the something twice.
> 
> Is there anything I can do about this information overload? 

I don’t think that location info (file & line number) is currently exposed for use in script-layer logic, but it is available internally (that’s why error messages are able to provide it).

I can think of a few methods to patch the functionality in.  One would be to change global_ids() to accept an optional argument to filter results to a particular script and/or have its return value provide the location information for each identifier.  Another would be to add a builtin-function specifically for retrieving location info given a single identifier.

Either seems like a reasonable request if you want to create a ticket at tracker.bro.org.  A patch would probably also be welcomed/accepted if you’re able/willing to try to make one.

- Jon



More information about the Bro mailing list