[Discussion] Submitted Ideas

[Martin Fong]

Matt Jonkman wrote:

> With global how do we keep streams from walking over each other?
> 
> Maybe make arrays that the check could be against every element of the
> array and if a match then there'd eb the reference to the stream it was
> from and further checks could be done for other vars in just that stream...

Actually, this was the thought behind the "Variable Blackboard" item.
Basically, I think that general problem is the storage of derived or
extracted data -- and this is complicated by namespace and scoping
issues.  For example, can Julien's storage of pcre extracted data into
a packet's context be extended for multiple processors with differing
(opaque) data structures (-- in my field formatter implementation, I
extended the OptTreeNode data structure)?  Where would we store global
versus stream-specific data?

      Could we define a principled and unified approach that would
reduce the complexity and diversity of accessor/setter methods and
storage locations?

      Cheers!

      ...Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5193 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.openinfosecfoundation.org/pipermail/discussion/attachments/20090206/4ab1405a/attachment.bin>