2015-06-19 3:07 GMT+03:00 Mark D. Nagel <[email protected]>: > Here is my pending new rule -- just want a sanity check on my internals > access. I know > you have sometimes suggested it, and in this case it would be the cleanest > method for me > to jump to a cfset only if it has been defined, rather than having to > maintain a separate > hash. Ultimately I am trying to optimize the default jump from what is > currently a few > dozen rules and could grow to much more as I add more event source > subrulesets. > > type=Jump > ptype=PerlFunc > constset=no > pattern=sub { my $cfset = "windows_\L$WINDOWS{SourceName}"; if > (defined($main::cfset2cfile{$cfset})) { $WINDOWS{_jump_cfset} = $cfset; > return \%WINDOWS } > return 0 } > cfset=$+{_jump_cfset} > > ...the check for the set name key in the %cfset2cfile hash should work nicely, since this hash serves as a mapping between set names and rule file names. If the set name does not exist, there is no key in this hash (internally, SEC uses the same check as you have implemented in the rule).
kind regards, risto Thanks, > Mark > > > > ------------------------------------------------------------------------------ > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users >
------------------------------------------------------------------------------
_______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
