[
https://bro-tracker.atlassian.net/browse/BIT-1504?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Johanna Amann updated BIT-1504:
-------------------------------
Priority: Low (was: High)
> The facility to serialize tables to a log
> -----------------------------------------
>
> Key: BIT-1504
> URL: https://bro-tracker.atlassian.net/browse/BIT-1504
> Project: Bro Issue Tracker
> Issue Type: New Feature
> Components: Bro
> Reporter: Aaron Eppert
> Priority: Low
>
> ```@load base/protocols/http/main
> @load base/protocols/http/utils
> module HTTP;
> redef record Info += {
> cookies: table[string] of string &optional &log;
> };
> event http_header(c: connection, is_orig: bool, name: string, value: string)
> {
> if ( is_orig && name == "COOKIE" ) {
> if ( ! c$http?$cookies ) {
> c$http$cookies = table();
> }
>
> local cookie_vec = split_string(value, /;[[:blank:]]*/);
>
> for (cookie in cookie_vec) {
> local kv = split_string(value, /=/);
> if (|kv| == 2) {
> c$http$cookies[kv[0]] = kv[1];
> }
> }
> }
> }
> ```
> Simple example. The ability to serialize the above to a log file, given it
> uses simple string indices and values would seem to be straight forward per
> looking at the Ascii and JSON writers, which appear to support TYPE_TABLE
> natively. I spent some time looking at how to implement this at the layers
> above, but the (!t->IsSet()) in SerialTypes.cc's Value::IsCompatibleType(...)
> is an obvious blocker and I ran out of time to deduce the rest.
> I would assume I am not alone in this want as it would make proper downstream
> referencing of the resulting KV pairs from the table especially easy to
> navigate. This is, again, very much the case when using the JSON writer given
> it should natively serialize into very easily usable KV pair notation.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-08-005#70107)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
