Global and Local Variables

From BroWiki

Contents 1 Overview 2 Scope 3 Assignment & call semantics 4 Modifiability 5 Typing 6 Initialization 7 Attributes 8 Refinement

Overview

Bro variables can be complicated to understand because they have a number of possibilities and features. They can be global or local in scope; modifiable or constant (unchangeable); explicitly or implicitly typed; optionally initialized; defined to have additional attributes; and, for global variables, redefined to have a different initialization or different attributes from their first declaration.

Rather than giving the full syntax for variable declarations, which is messy, in the following sections we discuss each of these facets of variables in turn, illustrating them with the minimal necessary syntax. However, keep in mind that the features can be combined as needed in a variable declaration.

Scope

Assignment & call semantics

Modifiability

Typing

Initialization

Attributes

When defining a variable, you can optionally specify a set of attributes associated with the variable, which specify additional properties associated with it. Attributes have two forms:

&attr

for attributes that are specified simply using their name, and

&attr = expr

for attributes that have a value associated with them.

The attributes &redef, &add_func and &delete_func, pertain to redefining variables; they are discussed in #Refinement.

The attributes &default, &create_expire, &read_expire, $write_expire and &expire_func are for use with table's and set's. See #Table Attributes for discussion.

The attribute &optional specifies that a record field is optional.

Finally, to specify multiple attributes, you do not separate them with commas (doing so would actually make Bro's grammar ambiguous), but just list them one after another. For example:

global a: table[port] of string &redef &default="missing";

Refinement